joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4185c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x81c
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x818], eax
mov eax, dword [esp + 0x824]
push ebp
mov ebp, dword [esp + 0x824]
push edi
push 0x3ff
lea ecx, [esp + 0x25]
push 0
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], str.ProgramFiles
mov dword [esp + 0x20], str.ProgramData
mov dword [esp + 0x24], str.SystemRoot
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
call fcn.0046faa0
push 0x3ff
lea edx, [esp + 0x431]
push 0
push edx
mov byte [esp + 0x438], 0
call fcn.0046faa0
push ebp
push esi
push str.__s___s__n
call fcn.0042c2e0
add esp, 0x24
cmp dword [0x4e25b0], 0
je 0x41874a
lea edi, [esp + 0x10]
mov eax, str.ProgramFiles
nop
push eax
call fcn.00474aa2
add esp, 4
test eax, eax
je 0x41867b
push eax
push esi
call fcn.00472cf0
add esp, 8
test eax, eax
jne 0x41869c
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
jne 0x418660
pop edi
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0046fa34
add esp, 0x81c
ret
cmp dword [edi], 0
je 0x41874a
lea eax, [esp + 8]
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x41874a
mov edx, dword [esp + 8]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0xffffffffffffffff
push str.VirtualStore
lea ecx, [esp + 0x28]
push 0x400
push ecx
call fcn.004723db
push 0x4a76cc
push esi
call fcn.00472cf0
add esp, 0x18
test eax, eax
je 0x418717
push 0xffffffffffffffff
add eax, 1
push eax
lea edx, [esp + 0x28]
push 0x400
push edx
call fcn.004723db
add esp, 0x10
push ebp
lea eax, [esp + 0x24]
push eax
push str._s_s
lea ecx, [esp + 0x42c]
push 0x400
push ecx
call fcn.004168c0
lea edx, [esp + 0x434]
push 0
push edx
call fcn.00472832
add esp, 0x1c
test eax, eax
je 0x418763
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.0046fa34
add esp, 0x81c
ret
mov ecx, dword [esp + 0x830]
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push ecx
push edx
call fcn.0046fb1a
mov ecx, dword [esp + 0x830]
add esp, 0x10
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.0046fa34
add esp, 0x81c
ret
Function at 0x41bcd0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [esp + 0x80c]
push esi
mov esi, dword [0x4d1b44]
mov dl, byte [esi + eax]
and dl, 0x40
mov ecx, eax
je 0x41bd09
lea esp, [esp]
sub ecx, 1
test byte [esi + ecx], 0x40
jne 0x41bd00
add ecx, 1
test dl, dl
je 0x41bd19
add eax, 1
test byte [esi + eax], 0x40
jne 0x41bd10
sub eax, 1
lea edx, [ecx + 0x3ff]
cmp edx, eax
jg 0x41bd2c
lea eax, [ecx + 0x3fe]
sub eax, ecx
add eax, 1
test eax, eax
push ebp
lea ebp, [esp + 0xc]
jle 0x41bd7b
mov esi, dword [0x4d76a8]
push ebx
push edi
lea edi, [esi - 1]
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, dword [0x4d1b3c]
mov bl, byte [ecx + eax]
mov eax, ecx
cdq
idiv esi
cmp edx, edi
jne 0x41bd69
cmp bl, byte [0x4d9bfe]
je 0x41bd6f
mov byte [ebp], bl
add ebp, 1
add ecx, 1
sub dword [esp + 0x10], 1
jne 0x41bd50
pop edi
pop ebx
push 7
lea ecx, [esp + 0x10]
push str.http:__
push ecx
mov byte [ebp], 0
call fcn.004754be
add esp, 0xc
test eax, eax
pop ebp
je 0x41bdd8
push 8
lea edx, [esp + 0xc]
push str.https:__
push edx
call fcn.004754be
add esp, 0xc
test eax, eax
je 0x41bdd8
push 6
lea eax, [esp + 0xc]
push str.ftp:__
push eax
call fcn.004754be
add esp, 0xc
test eax, eax
je 0x41bdd8
push 1
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
jmp 0x41be67
mov eax, 0x4d97c4
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41bde0
sub eax, edx
je 0x41be5c
lea edx, [esp + 8]
push edx
push 0x4d98c8
push str._s__s
push 0xffffffffffffffff
lea eax, [esp + 0x418]
push 0x400
push eax
call fcn.0046f96e
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
push 1
push 0
lea ecx, [esp + 0x410]
push ecx
push 0x4d97c4
push 0
push 0
call esi
cmp eax, 0x20
jge 0x41be71
push 1
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0
call esi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0046fa34
add esp, 0x808
ret
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
call fcn.0046fa34
add esp, 0x808
ret
Function at 0x4247e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4c1674]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x4247f5
mov eax, dword [esp + 0x1c]
add esp, 0x14
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ClearCommError]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
call esi
cmp dword [0x4d1dd4], 0
mov ecx, dword [esp + 0x20]
jne 0x424825
mov eax, 0x4000
sub eax, dword [esp + 0x14]
cmp eax, ecx
jge 0x424825
mov ecx, eax
test ecx, ecx
jg 0x424830
xor eax, eax
pop esi
add esp, 0x14
ret
mov edx, dword [0x4c1674]
push 0
lea eax, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x424852
mov dword [esp + 4], eax
mov ecx, dword [0x4c1674]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
call esi
mov eax, dword [esp + 4]
pop esi
add esp, 0x14
ret
Function at 0x426eb0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x4d204c], 0
je 0x426ebf
mov eax, 1
ret
push str.TTPTEK.DLL
call fcn.0042e180
add esp, 4
test eax, eax
mov dword [0x4d204c], eax
jne 0x426ed6
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 1
push eax
xor edi, edi
call esi
test eax, eax
mov dword [0x4e262c], eax
jne 0x426ef1
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 2
push eax
call esi
test eax, eax
mov dword [0x4e2668], eax
jne 0x426f07
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 3
push ecx
call esi
test eax, eax
mov dword [0x4e2634], eax
jne 0x426f1e
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 4
push edx
call esi
test eax, eax
mov dword [0x4e265c], eax
jne 0x426f35
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 5
push eax
call esi
test eax, eax
mov dword [0x4e264c], eax
jne 0x426f4b
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 6
push ecx
call esi
test eax, eax
mov dword [0x4e263c], eax
jne 0x426f62
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 7
push edx
call esi
test eax, eax
mov dword [0x4e2630], eax
jne 0x426f79
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 8
push eax
call esi
test eax, eax
mov dword [0x4e2644], eax
jne 0x426f8f
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 9
push ecx
call esi
test eax, eax
mov dword [0x4e2620], eax
jne 0x426fa6
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 0xa
push edx
call esi
test eax, eax
mov dword [0x4e2658], eax
jne 0x426fbd
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 0xb
push eax
call esi
test eax, eax
mov dword [0x4e2638], eax
jne 0x426fd3
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 0xc
push ecx
call esi
test eax, eax
mov dword [0x4e2660], eax
jne 0x426fea
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 0xd
push edx
call esi
test eax, eax
mov dword [0x4e2628], eax
jne 0x427001
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 0xe
push eax
call esi
test eax, eax
mov dword [0x4e2654], eax
jne 0x427017
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 0xf
push ecx
call esi
test eax, eax
mov dword [0x4e2648], eax
jne 0x42702e
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 0x10
push edx
call esi
test eax, eax
mov dword [0x4e2664], eax
jne 0x427045
lea edi, [eax + 1]
mov eax, dword [0x4d204c]
push 0x11
push eax
call esi
test eax, eax
mov dword [0x4e2640], eax
jne 0x42705b
lea edi, [eax + 1]
mov ecx, dword [0x4d204c]
push 0x12
push ecx
call esi
test eax, eax
mov dword [0x4e2650], eax
jne 0x427072
lea edi, [eax + 1]
mov edx, dword [0x4d204c]
push 0x13
push edx
call esi
test eax, eax
mov dword [0x4e2624], eax
jne 0x42708b
lea edi, [eax + 1]
jmp 0x42708f
test edi, edi
je 0x4270a5
mov eax, dword [0x4d204c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4d204c], 0
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
ret
Function at 0x428020
Capabilities:
Create thread

Disassembly:
push ecx
mov ax, word [0x4d9226]
test ax, ax
jbe 0x428083
mov ecx, dword [0x4d2994]
mov edx, dword [0x4da060]
push 0
push 0x427f30
push ecx
movzx eax, ax
push 0x70
push edx
mov dword [0x4d23e8], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4d23e4], eax
lea eax, [esp]
push eax
push 0
push 0
push 0x427f90
push 0
push 0
call fcn.00472597
add esp, 0x18
cmp eax, 0xffffffff
mov dword [0x4c1868], eax
jne 0x428083
mov dword [0x4d23e8], 0
pop ecx
ret

Function at 0x42a4f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x180
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x17c], eax
push ebx
mov ebx, dword [esp + 0x18c]
push edi
mov edi, dword [esp + 0x18c]
test edi, edi
jne 0x42a545
test ebx, ebx
jne 0x42a545
cmp dword [0x4d2820], ebx
je 0x42a545
push 1
call fcn.00428160
add esp, 4
pop edi
pop ebx
mov ecx, dword [esp + 0x17c]
xor ecx, esp
call fcn.0046fa34
add esp, 0x180
ret
call fcn.00428290
call fcn.0042a3f0
test eax, eax
je 0x42a662
push 0xffffffffffffffff
push str.TTPMACRO__D
lea eax, [esp + 0x64]
push 0x128
push eax
call fcn.0046fb1a
push 0xffffffffffffffff
push 0x4d2808
lea ecx, [esp + 0x74]
push 0x128
push ecx
call fcn.004723db
add esp, 0x20
test edi, edi
je 0x42a5de
push 0xffffffffffffffff
push 0x4a75a0
lea edx, [esp + 0x64]
push 0x128
push edx
call fcn.004723db
lea eax, [esp + 0x6c]
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42a5b0
push esi
push 0xffffffffffffffff
sub eax, edx
push edi
mov esi, eax
lea eax, [esp + 0x68]
push 0x128
push eax
call fcn.004723db
lea ecx, [esp + esi + 0x70]
push ecx
call fcn.0042b4e0
add esp, 0x14
pop esi
test ebx, ebx
mov dword [0x4d2848], ebx
je 0x42a601
push 0xffffffffffffffff
push 0x4a88b8
lea edx, [esp + 0x64]
push 0x128
push edx
call fcn.004723db
add esp, 0x10
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0046faa0
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov word [esp + 0x70], 6
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42a662
call fcn.00428700
mov ecx, dword [esp + 0x184]
pop edi
pop ebx
xor ecx, esp
call fcn.0046fa34
add esp, 0x180
ret
Function at 0x42a680
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x4d2864], 0
push edi
jne 0x42a7e5
push str.TTPDLG.DLL
mov dword [0x4d2868], 0
call fcn.0042e180
add esp, 4
test eax, eax
mov dword [0x4d2864], eax
je 0x42a7d7
push esi
push 0x4d8d16
call sub.ttpdlg.dll_Ordinal_12_2
mov eax, dword [0x4d2864]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push eax
xor edi, edi
call esi
test eax, eax
mov dword [0x4e25f0], eax
jne 0x42a6db
lea edi, [eax + 1]
mov ecx, dword [0x4d2864]
push 2
push ecx
call esi
test eax, eax
mov dword [0x4e25f8], eax
jne 0x42a6f2
lea edi, [eax + 1]
mov edx, dword [0x4d2864]
push 3
push edx
call esi
test eax, eax
mov dword [0x4e2608], eax
jne 0x42a709
lea edi, [eax + 1]
mov eax, dword [0x4d2864]
push 4
push eax
call esi
test eax, eax
mov dword [0x4e2614], eax
jne 0x42a71f
lea edi, [eax + 1]
mov ecx, dword [0x4d2864]
push 5
push ecx
call esi
test eax, eax
mov dword [0x4e25fc], eax
jne 0x42a736
lea edi, [eax + 1]
mov edx, dword [0x4d2864]
push 6
push edx
call esi
test eax, eax
mov dword [0x4e2610], eax
jne 0x42a74d
lea edi, [eax + 1]
mov eax, dword [0x4d2864]
push 7
push eax
call esi
test eax, eax
mov dword [0x4e260c], eax
jne 0x42a763
lea edi, [eax + 1]
mov ecx, dword [0x4d2864]
push 8
push ecx
call esi
test eax, eax
mov dword [0x4e2618], eax
jne 0x42a77a
lea edi, [eax + 1]
mov edx, dword [0x4d2864]
push 9
push edx
call esi
test eax, eax
mov dword [0x4e25f4], eax
jne 0x42a791
lea edi, [eax + 1]
mov eax, dword [0x4d2864]
push 0xa
push eax
call esi
test eax, eax
mov dword [0x4e2600], eax
jne 0x42a7a7
lea edi, [eax + 1]
mov ecx, dword [0x4d2864]
push 0xb
push ecx
call esi
test eax, eax
mov dword [0x4e2604], eax
pop esi
je 0x42a7c0
test edi, edi
je 0x42a7db
mov edx, dword [0x4d2864]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4d2864], 0
xor eax, eax
pop edi
ret
push 0x4c18f0
call fcn.0042d770
add dword [0x4d2868], 1
mov eax, 1
pop edi
ret
Function at 0x42a8a0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x508
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x504], eax
cmp dword [0x4d28c4], 0
je 0x42a8d7
mov eax, 1
mov ecx, dword [esp + 0x504]
xor ecx, esp
call fcn.0046fa34
add esp, 0x508
ret
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
push str.imm32.dll
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.004723db
add esp, 0x10
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4d28c4], eax
jne 0x42a9aa
push 0x4d8d16
push str.Tera_Term:_Error
push 0x400
lea eax, [esp + 0x110]
push eax
push str.MSG_TT_ERROR
call fcn.0042c140
push 0x4d8d16
push str.Cant_use_IME
push 0x400
push 0x4d8e1a
push str.MSG_USE_IME_ERROR
call fcn.0042c140
add esp, 0x28
push 0x30
lea ecx, [esp + 0x108]
push ecx
push 0x4d8e1a
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x4d79c0
push 0x4a41ec
push 0x4a8970
push str.Tera_Term
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov word [0x4d867a], 0
xor eax, eax
mov ecx, dword [esp + 0x504]
xor ecx, esp
call fcn.0046fa34
add esp, 0x508
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x4a8954
push eax
xor edi, edi
call esi
test eax, eax
mov dword [0x4d28b0], eax
jne 0x42a9c8
lea edi, [eax + 1]
mov edx, dword [0x4d28c4]
push 0x4a8944
push edx
call esi
test eax, eax
mov dword [0x4d28ac], eax
jne 0x42a9e2
lea edi, [eax + 1]
mov eax, dword [0x4d28c4]
push 0x4a8930
push eax
call esi
test eax, eax
mov dword [0x4d28a8], eax
jne 0x42a9fb
lea edi, [eax + 1]
mov ecx, dword [0x4d28c4]
push str.ImmSetCompositionFontA
push ecx
call esi
test eax, eax
mov dword [0x4d28b4], eax
jne 0x42aa15
lea edi, [eax + 1]
mov edx, dword [0x4d28c4]
push str.ImmSetCompositionWindow
push edx
call esi
test eax, eax
mov dword [0x4d28c0], eax
jne 0x42aa2f
lea edi, [eax + 1]
mov eax, dword [0x4d28c4]
push 0x4a88ec
push eax
call esi
test eax, eax
mov dword [0x4d28bc], eax
jne 0x42aa48
lea edi, [eax + 1]
mov ecx, dword [0x4d28c4]
push str.ImmSetOpenStatus
push ecx
call esi
test eax, eax
mov dword [0x4d28b8], eax
je 0x42aa63
test edi, edi
je 0x42aa93
mov edx, dword [0x4d28c4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov dword [0x4d28c4], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x504]
xor ecx, esp
call fcn.0046fa34
add esp, 0x508
ret
mov ecx, dword [esp + 0x50c]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0046fa34
add esp, 0x508
ret
Function at 0x42acd0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
xor edx, edx
test edi, edi
je 0x42adfa
test eax, eax
je 0x42adfa
test ebp, ebp
je 0x42adfa
cmp edi, 5
jge 0x42ad04
pop edi
mov byte [eax], cl
pop ebp
ret
cmp dword [esp + 0x18], ecx
push ebx
push esi
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jle 0x42ad81
movzx ebx, byte [ebp]
sub dword [esp + 0x20], 1
shl ecx, 8
add edx, 1
or ecx, ebx
add ebp, 1
cmp edx, 3
jne 0x42ad7a
mov edx, ecx
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [eax], dl
mov edx, ecx
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [eax + 1], dl
add eax, 1
mov edx, ecx
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
add eax, 1
mov byte [eax], dl
and ecx, 0x3f
mov cl, byte [ecx + esi]
add eax, 1
mov byte [eax], cl
sub edi, 4
add eax, 1
xor edx, edx
xor ecx, ecx
cmp edi, 5
jl 0x42adf5
cmp dword [esp + 0x20], 0
jg 0x42ad12
cmp edi, 5
jl 0x42adf5
cmp edx, 1
jne 0x42adbd
mov edx, ecx
shr edx, 2
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [eax], dl
and ecx, 3
add eax, 1
shl ecx, 4
mov cl, byte [ecx + esi]
mov byte [eax], cl
add eax, 1
mov byte [eax], 0x3d
pop esi
add eax, 1
pop ebx
mov byte [eax], 0x3d
add eax, 1
pop edi
mov byte [eax], 0
pop ebp
ret
cmp edx, 2
jne 0x42adf5
mov edx, ecx
shr edx, 0xa
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [eax], dl
mov edx, ecx
shr edx, 4
and edx, 0x3f
movzx edx, byte [edx + esi]
add eax, 1
mov byte [eax], dl
and ecx, 0xf
mov cl, byte [esi + ecx*4]
add eax, 1
mov byte [eax], cl
add eax, 1
mov byte [eax], 0x3d
add eax, 1
pop esi
mov byte [eax], 0
pop ebx
pop edi
pop ebp
ret
Function at 0x42be10
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x220]
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x224]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp + 0x10]
push ecx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42bef5
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0xffffffffffffffff
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.0046fb1a
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.0042b140
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x34]
push 0x104
push eax
call fcn.004723db
add esp, 0x28
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bf01
mov eax, dword [esp + 0x230]
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push edx
push eax
push esi
call fcn.0046fb1a
add esp, 0x10
jmp 0x42bf26
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0xffffffffffffffff
push edi
mov edi, dword [esp + 0x238]
push edi
push esi
call fcn.0046fb1a
push edi
push esi
call fcn.0042b140
push 0xffffffffffffffff
push ebx
push edi
push esi
call fcn.004723db
add esp, 0x28
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046fa34
add esp, 0x214
ret 0x10
Function at 0x42c1f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x130
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x138]
push ebx
mov ebx, dword [esp + 0x148]
push ebp
push esi
mov esi, dword [esp + 0x140]
push edi
mov edi, dword [esp + 0x150]
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42c23f
xor eax, eax
jmp 0x42c2bb
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea eax, [esp + 0x38]
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], 0x42c1c0
mov dword [esp + 0x34], edi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, eax
test esi, esi
je 0x42c2b2
lea edx, [esp + 0x38]
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x42c2af
mov ecx, dword [esp + 0x14c]
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
lea eax, [esp + 0x3c]
push eax
push ecx
push edx
call fcn.0046fb1a
add esp, 0x10
mov ebp, 1
push esi
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
mov eax, ebp
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046fa34
add esp, 0x130
ret

Function at 0x42c2e0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x400], eax
mov ecx, dword [esp + 0x408]
lea eax, [esp + 0x40c]
push eax
push ecx
lea edx, [esp + 8]
push 0x400
push edx
call fcn.00476866
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0046fa34
add esp, 0x404
ret

Function at 0x42c790
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x4cbbe8]
xor eax, esp
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
push str.kernel32.dll
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.004723db
add esp, 0x10
cmp dword [0x4d28fc], 0
jne 0x42c7fc
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x4d28fc], eax
je 0x42c7fc
push str.VerSetConditionMask
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d2900], eax
jmp 0x42c801
mov eax, dword [0x4d2900]
test eax, eax
jne 0x42c842
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esp + 0x110]
push eax
mov eax, dword [esp + 0x110]
push ecx
push edx
push eax
call fcn.0042c580
add esp, 0x10
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0046fa34
add esp, 0x108
ret
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push ecx
mov ecx, dword [esp + 0x114]
push edx
mov edx, dword [esp + 0x114]
push ecx
push edx
call eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0046fa34
add esp, 0x108
ret