joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f770
Capabilities:
Delete file

Disassembly:
push ebx
push edi
mov edi, ecx
test edi, edi
jne 0x41f795
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret
cmp byte [edi], 0
push esi
jne 0x41f7c4
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x41f847
jmp 0x41f83e
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x41f80f
push 2
push ebx
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x41f80f
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
cmp eax, ebx
je 0x41f82e
call fcn.004d1211
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004d1211
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret

Function at 0x41f8a0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41f909
cmp byte [esi], 0
jne 0x41f8be
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x41f90b
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x41f909
push 2
push ebx
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x41f909
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x41f90b
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
cmp word [edi], 0x22
jne 0x41f953
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f916
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x22
jne 0x41f953
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f932
sub ecx, edx
sar ecx, 1
xor eax, eax
push 0x80
mov word [edi + ecx*2 - 2], ax
lea eax, [edi + 2]
push eax
jmp 0x41f959
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004d1211
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x41f980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
push edi
push 0x104
push 0
push eax
mov edi, edx
mov dword [ebp - 0x120], ebx
call fcn.004ab0f0
mov eax, dword [ebp + 0x10]
push eax
push 0
push ebx
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x118], eax
call fcn.004ab0f0
add esp, 0x18
test edi, edi
je 0x41fbcc
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x41fa00
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esi, ecx
je 0x41fa1c
cmp byte [edi + esi], 0x5c
je 0x41fa51
sub esi, 1
jne 0x41fa11
lea eax, [ebp - 0x110]
push eax
push 0x2001d
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41fb15
mov dword [ebp - 0x110], 0
jmp 0x41fba8
cmp esi, 0x104
jae 0x41fbcc
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41fa62
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x41fa8c
mov ecx, edi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41fa80
sub ecx, edx
inc ecx
jmp 0x41fa91
mov ecx, 0x104
push ecx
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004aab70
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41faa7
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x41facc
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41fac0
sub ecx, edx
inc ecx
jmp 0x41fad1
mov ecx, 0x104
lea eax, [ebp - 0x10c]
mov byte [ebp + ecx - 0x109], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push eax
push 0x80000001
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41fb4e
mov dword [ebp - 0x10c], 0
jmp 0x41fb9b
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 7
push 0
push 0
push 0
push str.Akeo_ConsultingRufus
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x41fb4e
mov dword [ebp - 0x10c], 0
jmp 0x41fb9b
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x120]
lea eax, [ebp - 0x114]
push eax
push 0
lea eax, [edi + esi]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x41fb91
test eax, eax
jne 0x41fb9b
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp + 8]
jne 0x41fb9b
cmp dword [ebp - 0x118], 0
jbe 0x41fb9b
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x41fba8
push eax
call ebx
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x41fbb5
push ecx
call ebx
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
Function at 0x41fbe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
mov edi, edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
test edi, edi
jne 0x41fc15
push 0x8a
push str.D:_a_rufus_rufus_src_registry.h
push str.key_name___NULL
call fcn.004dfbbc
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0x5c
push edi
call fcn.004aa320
add esp, 8
test eax, eax
je 0x41fc3b
push 0x91
push str.D:_a_rufus_rufus_src_registry.h
push str.strchr_key_name_____NULL
call fcn.004dfbbc
add esp, 0xc
push 0x5c
push edi
call fcn.004aa320
add esp, 8
test eax, eax
jne 0x41fc0d
lea eax, [ebp - 4]
push eax
push 0x2001d
push 0
push 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41fc6b
mov dword [ebp - 4], esi
jmp 0x41fcbc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 7
push 0
push 0
push 0
push str.SOFTWAREAkeo_ConsultingRufus
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x41fc94
mov dword [ebp - 8], esi
jmp 0x41fcae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb esi, esi
inc esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41fcbc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41fcca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428850
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10b]
push 0xff
mov ebx, edx
mov dword [ebp - 0x12c], ecx
push 0
push eax
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0x206
mov dword [ebp - 0x11c], 0xa400
mov dword [ebp - 0x118], 0x31415352
mov dword [ebp - 0x114], 0x800
mov dword [ebp - 0x110], 0x10001
mov byte [ebp - 0x10c], 0
call fcn.004ab0f0
add esp, 0xc
lea eax, [ebp - 0x128]
push 0xf0000008
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, eax
test esi, esi
jne 0x428908
call fcn.00427540
push eax
push str.PKI:_Could_not_create_the_default_key_container:__s
jmp 0x428a14
xor ecx, ecx
mov edx, 0x527568
nop
mov al, byte [edx]
lea edx, [edx - 1]
mov byte [ebp + ecx - 0x10c], al
inc ecx
cmp ecx, 0x100
jb 0x428910
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push 0x114
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov esi, eax
test esi, esi
jne 0x42895e
call fcn.00427540
push eax
push str.PKI:_Could_not_import_public_key:__s
jmp 0x428a14
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov esi, eax
test esi, esi
jne 0x428990
call fcn.00427540
push eax
push str.PKI:_Could_not_create_empty_hash:__s
jmp 0x428a14
push 0
push ebx
push dword [ebp - 0x12c]
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, eax
test esi, esi
jne 0x4289b8
call fcn.00427540
push eax
push str.PKI:_Could_not_hash_data:__s
jmp 0x428a14
mov ebx, dword [ebp + 0xc]
xor esi, esi
lea edx, [ebx - 1]
test edx, edx
jle 0x4289d6
mov al, byte [edi + edx]
mov cl, byte [edi + esi]
mov byte [edi + esi], al
inc esi
mov byte [edi + edx], cl
dec edx
cmp esi, edx
jl 0x4289c4
push 0
push 0
push dword [ebp - 0x130]
push ebx
push edi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
mov esi, eax
test esi, esi
jne 0x428a1c
push dword [ebp - 0x134]
push eax
push dword [ebp - 0x12c]
call fcn.004ab0f0
add esp, 0xc
call fcn.00427540
push eax
push str.Signature_validation_failed:__s
call fcn.0044b0b0
add esp, 8
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x428a2d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x428a40
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
Function at 0x429400
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x59bd48], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov dword [ebp - 4], ecx
jne 0x429444
push str.NtQuerySystemInformation
push ecx
mov ecx, str.Ntdll
call fcn.00428ea0
add esp, 4
push eax
call ebx
mov dword [0x59bd48], eax
test eax, eax
jne 0x429444
mov eax, 0xc000007a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x59bd24]
mov esi, dword [0x553774]
test ecx, ecx
je 0x4295e5
mov eax, dword [0x59bd7c]
test eax, eax
jne 0x42948a
push str.RtlAllocateHeap
push ecx
mov ecx, str.Ntdll
call fcn.00428ea0
add esp, 4
push eax
call ebx
mov dword [0x59bd7c], eax
test eax, eax
je 0x4295e5
mov ecx, dword [0x59bd24]
push esi
push 0
push ecx
call eax
mov edi, eax
test edi, edi
je 0x4295e5
push 0
push esi
push edi
push 0x40
call dword [0x59bd48]
mov ebx, eax
cmp ebx, 0xc0000004
jne 0x42956e
cmp dword [0x59bd24], 0
je 0x4294f4
mov eax, dword [0x59bd34]
test eax, eax
jne 0x4294e9
push str.RtlFreeHeap
push ecx
mov ecx, str.Ntdll
call fcn.00428ea0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59bd34], eax
test eax, eax
je 0x4294f4
push edi
push 0
push dword [0x59bd24]
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x4295bd
cmp dword [0x59bd24], 0
je 0x4295e5
mov eax, dword [0x59bd7c]
test eax, eax
jne 0x42953f
push str.RtlAllocateHeap
push ecx
mov ecx, str.Ntdll
call fcn.00428ea0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59bd7c], eax
test eax, eax
je 0x4295e5
push esi
push 0
push dword [0x59bd24]
call eax
mov edi, eax
test edi, edi
je 0x4295e5
push 0
push esi
push edi
push 0x40
call dword [0x59bd48]
mov ebx, eax
cmp ebx, 0xc0000004
je 0x4294b4
test ebx, ebx
jns 0x4295c9
mov edx, dword [0x59bd24]
test edx, edx
je 0x4295b4
mov eax, dword [0x59bd34]
test eax, eax
jne 0x4295ae
push str.RtlFreeHeap
push ecx
mov ecx, str.Ntdll
call fcn.00428ea0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x59bd34], eax
test eax, eax
je 0x4295b4
mov edx, dword [0x59bd24]
push edi
push 0
push edx
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xc000009a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x200000
ja 0x4295d7
mov dword [0x553774], esi
mov eax, dword [ebp - 4]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xc0000017
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c620
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
push edi
mov edi, edx
lea eax, [esi + 0x57]
test edi, edi
je 0x42c6a2
mov esi, dword [ebp + 8]
push ebx
push 2
push esi
mov byte [edi], 0
call fcn.004b6706
add esp, 8
mov ebx, eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test esi, esi
je 0x42c689
push 0
push 0
push dword [ebp + 8]
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x42c689
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test ebx, ebx
je 0x42c696
push ebx
call fcn.004d1211
add esp, 4
mov eax, dword [ebp + 8]
pop ebx
mov byte [edi + eax - 1], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42c7c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x55a7ec]
push esi
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
test esi, esi
je 0x42c916
push ebx
push 2
push esi
call fcn.004b6706
add esp, 8
mov ebx, eax
call edi
test ebx, ebx
jne 0x42c814
mov eax, 0xe
xor esi, esi
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
call edi
mov dword [ebp - 4], eax
test esi, esi
je 0x42c909
cmp word [ebx], 0
jne 0x42c851
push 1
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
mov dword [ebp - 8], esi
call edi
test esi, esi
jne 0x42c8cf
jmp 0x42c8ad
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x42c8ab
push 1
push eax
call fcn.004b6706
mov esi, eax
add esp, 8
mov dword [ebp - 8], esi
test esi, esi
je 0x42c8ab
push 0
push 0
push dword [ebp - 4]
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 4]
je 0x42c8cd
push esi
call fcn.004d1211
add esp, 4
call edi
push ebx
xor esi, esi
call fcn.004d1211
add esp, 4
mov eax, 0xe
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call edi
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c8d4
sub ecx, edx
lea esi, [ecx + 2]
call edi
push ebx
mov dword [ebp - 4], eax
call fcn.004d1211
push dword [ebp - 8]
call fcn.004d1211
mov eax, dword [ebp - 4]
add esp, 8
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004d1211
mov eax, dword [ebp - 4]
add esp, 4
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42ccf0
Capabilities:
Delete file

Disassembly:
push ebx
push edi
mov edi, ecx
test edi, edi
jne 0x42cd15
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret
cmp byte [edi], 0
push esi
jne 0x42cd44
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x42cdc7
jmp 0x42cdbe
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x42cd8f
push 2
push ebx
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x42cd8f
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
cmp eax, ebx
je 0x42cdae
call fcn.004d1211
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004d1211
add esp, 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop ebx
ret

Function at 0x42cde0
Capabilities:
Check if file exists

Disassembly:
push edi
mov edi, ecx
test edi, edi
jne 0x42cdf0
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
ret
cmp byte [edi], 0
push ebx
push esi
jne 0x42ce16
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test esi, esi
jne 0x42ce75
pop esi
pop ebx
pop edi
ret
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x42ce61
push 2
push ebx
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x42ce61
push ebx
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
cmp eax, ebx
je 0x42ce6d
call fcn.004d1211
add esp, 4
push 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
pop ebx
pop edi
ret
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
push esi
call fcn.004d1211
add esp, 4
mov eax, edi
pop esi
pop ebx
pop edi
ret
Function at 0x42d150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x5a2660], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push edi
jne 0x42d178
push 2
push 1
call fcn.004b6706
add esp, 8
mov esi, eax
jmp 0x42d1c5
push 0
push 0
push 0xffffffffffffffff
push 0x5a2660
push 0
push 0xfde9
call ebx
mov edi, eax
cmp edi, 1
jle 0x42d1c3
push 2
push edi
call fcn.004b6706
mov esi, eax
add esp, 8
test esi, esi
je 0x42d1c3
push edi
push esi
push 0xffffffffffffffff
push 0x5a2660
push 0
push 0xfde9
call ebx
cmp eax, edi
je 0x42d1c5
push esi
call fcn.004d1211
add esp, 4
xor esi, esi
cmp byte [0x52b2c8], 0
jne 0x42d1de
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x42d22f
push 0
push 0
push 0xffffffffffffffff
push 0x52b2c8
push 0
push 0xfde9
call ebx
mov dword [ebp - 4], eax
cmp eax, 1
jle 0x42d22d
push 2
push eax
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x42d22d
push dword [ebp - 4]
push edi
push 0xffffffffffffffff
push 0x52b2c8
push 0
push 0xfde9
call ebx
cmp eax, dword [ebp - 4]
je 0x42d22f
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
cmp dword [ebp + 0xc], 0
jne 0x42d239
xor ebx, ebx
jmp 0x42d24a
push 2
push 0x104
call fcn.004b6706
add esp, 8
mov ebx, eax
push ebx
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 0
mov dword [ebp - 8], eax
je 0x42d293
push 0
push 0
push 0x104
push dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42d293
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x42d2a0
push ebx
call fcn.004d1211
add esp, 4
test edi, edi
je 0x42d2ad
push edi
call fcn.004d1211
add esp, 4
test esi, esi
je 0x42d2ba
push esi
call fcn.004d1211
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d470
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x42d4d9
cmp byte [esi], 0
jne 0x42d48e
push 2
push 1
call fcn.004b6706
add esp, 8
mov edi, eax
jmp 0x42d4db
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
cmp ebx, 1
jle 0x42d4d9
push 2
push ebx
call fcn.004b6706
mov edi, eax
add esp, 8
test edi, edi
je 0x42d4d9
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x42d4db
push edi
call fcn.004d1211
add esp, 4
xor edi, edi
cmp word [edi], 0x22
jne 0x42d51e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d4e6
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x22
jne 0x42d51e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d502
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [edi + ecx*2 - 2], ax
lea eax, [edi + 2]
push eax
jmp 0x42d51f
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004d1211
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret