joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428a80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5228db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x55930c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e6dbe
push 4
mov dword [esp + 0x20], 0
call fcn.004ecc6b
mov edi, eax
add esp, 4
test edi, edi
je 0x428afe
call fcn.004e7120
mov dword [edi], eax
call fcn.004e6f24
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004e6cff
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x428af3
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004e6d27
jmp 0x428b00
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x42dd10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x523688
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55930c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x42dd7a
cmp dword [edi + 0x18], eax
je 0x42dd7a
push ebx
push eax
call fcn.00426f20
test al, al
je 0x42dd7a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x42dd73
mov eax, dword [edi + 4]
jmp 0x42dd76
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x42df5b
jmp 0x42dd96
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x42df5b
cmp al, 0x5c
jne 0x42de97
cmp esi, ecx
je 0x42deb3
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x42ddd7.35
movzx eax, byte [eax + 0x42df9c]
jmp dword [eax*4 + 0x42df74]
push 0x22
jmp 0x42de9c
push 0x2f
jmp 0x42de9c
push 0x5c
jmp 0x42de9c
push 8
jmp 0x42de9c
push 0xc
jmp 0x42de9c
push 0xa
jmp 0x42de9c
push 0xd
jmp 0x42de9c
push 9
jmp 0x42de9c
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.0042dff0
test al, al
je 0x42deff
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x5c]
call fcn.0042bf40
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [esp + 0x8c], ebx
call fcn.00428470
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x42de79
mov ecx, dword [esp + 0x60]
push ecx
call fcn.004e9596
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
jmp 0x42dea4
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, edi
call fcn.00426c90
cmp esi, dword [esp + 0x18]
jne 0x42dd92
jmp 0x42df5b
push 0x1f
xor edi, edi
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
call fcn.004286a0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], edi
call fcn.0042e2a0
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x42df5b
mov eax, dword [esp + 0x28]
push eax
jmp 0x42df53
xor al, al
jmp 0x42df5d
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.004286a0
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x88], 2
call fcn.0042e2a0
cmp dword [esp + 0x58], 0x10
mov bl, al
jb 0x42df5b
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004e9596
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x43ab20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x43ab60
push 0
push 0
call fcn.004e96a2
add esp, 0x18
mov dword [ebp - 8], eax
mov esp, ebp
pop ebp
ret

Function at 0x43e510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 4]
call fcn.0043ca60
xor eax, eax
mov word [ebp - 0x420], ax
push 0x40e
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.004ed5e0
add esp, 0xc
mov dword [ebp - 8], 0x406
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0xc]
call fcn.0043caa0
push 0x52706c
lea ecx, [ebp - 0xc]
call fcn.0043cbd0
test eax, eax
jne 0x43e5a9
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 4]
call fcn.0043cb20
jmp 0x43e5e9
mov dword [ebp - 0x424], 1
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x424]
push eax
push 0x527060
push 0x526fe0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 4]
call fcn.0043cb20
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.0043ca80
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret

Function at 0x43e620
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
call fcn.0043e510
add esp, 4
push 0x527084
lea ecx, [ebp - 8]
call fcn.0043e6d0
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43e666
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
call fcn.0043cae0
mov eax, dword [ebp - 0xc]
jmp 0x43e699
lea ecx, [ebp - 8]
call fcn.0043cc50
push eax
call fcn.0043e6b0
add esp, 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0043e6a0
mov ecx, eax
call fcn.004947d0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
call fcn.0043cae0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x441220
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
cmp dword [ebp - 4], 0x18a88
jne 0x4412fe
push 0x18a88
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0043bf60
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
call fcn.0043ca60
call fcn.0048c6d0
mov ecx, eax
call fcn.0048e5a0
test eax, eax
je 0x441285
push 0x52797c
lea ecx, [ebp - 0x10]
call fcn.0043cb20
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0049ab30
add esp, 8
push 0x527988
lea ecx, [ebp - 0xc]
call fcn.0043caa0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x527990
lea eax, [ebp - 0xc]
push eax
call fcn.0043dc90
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x394
call fcn.0043cc50
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1e8
call fcn.00442990
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 0x10]
call fcn.0043cae0
jmp 0x4413c5
cmp dword [ebp - 4], 0x18a89
jne 0x441343
push 0x18a89
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0043bf60
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x398
call fcn.0043cc50
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x80
call fcn.00442990
jmp 0x4413c5
cmp dword [ebp - 4], 0x18a8a
jne 0x441385
push 0x18a8a
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0043bf60
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.0043cc50
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x260
call fcn.00442990
jmp 0x4413c5
cmp dword [ebp - 4], 0x18a8b
jne 0x4413c5
push 0x18a8b
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.0043bf60
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x39c
call fcn.0043cc50
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x2d8
call fcn.00442990
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x457140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x528d70
call fcn.004424d0
add esp, 4
test eax, eax
je 0x4571aa
call fcn.0043e240
mov ecx, eax
call fcn.00442440
test eax, eax
jne 0x457176
call fcn.0043e240
mov ecx, eax
call fcn.0043e2b0
push 0x528d7c
lea ecx, [ebp - 4]
call fcn.0043caa0
push 1
lea eax, [ebp - 4]
push eax
push 0x528d80
call fcn.004697f0
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00465f60
lea ecx, [ebp - 4]
call fcn.0043cae0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
cmp dword [edx + 0x520], 0
je 0x4571f3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x8f0], 0
je 0x4571f3
push 0
push 0
push 0
push 0xa
push 0x528d8c
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x8f0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x8f0]
mov edx, dword [edx]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 8]
call fcn.00465bf0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x465570
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x10]
call fcn.0043ca60
push ecx
mov ecx, esp
push 0x52ae54
call fcn.0043caa0
push ecx
mov ecx, esp
push str.newcentervip.ini
call fcn.0043caa0
push ecx
mov ecx, esp
push 0x52ae7c
call fcn.0043caa0
lea eax, [ebp - 0x10]
push eax
call fcn.0046f030
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465638
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
and ecx, 1
je 0x4655fd
mov edx, dword [ebp - 0x14]
and edx, 0xfffffffe
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x14]
and ecx, 2
je 0x465621
mov edx, dword [ebp - 0x14]
and edx, 0xfffffffd
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x10]
call fcn.0043cae0
mov eax, dword [ebp - 0x24]
jmp 0x4656bf
mov ecx, 0xfeff
mov word [ebp - 0xc], cx
push 0
push 0x80
push 2
push 0
push 7
push 0x40000000
lea ecx, [ebp - 0x10]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46567f
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x10]
call fcn.0043cae0
mov eax, dword [ebp - 0x28]
jmp 0x4656bf
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x10]
call fcn.0043cae0
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x4656d0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x264], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x260], 0
push 0x24c
push 0
lea eax, [ebp - 0x25c]
push eax
call fcn.004ed5e0
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0043ca60
lea ecx, [ebp - 0xc]
call fcn.0043ca60
mov ecx, dword [ebp + 8]
push ecx
push str._s.
lea edx, [ebp - 4]
push edx
call fcn.0043dc90
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4657be
mov ecx, dword [ebp - 0x260]
and ecx, 0x10
jne 0x465798
movzx edx, word [ebp - 0x234]
cmp edx, 0x2e
jne 0x46576d
jmp 0x465798
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x52ae98
lea edx, [ebp - 0xc]
push edx
call fcn.0043dc90
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x465754
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp + 8]
call fcn.0043cae0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret 4
Function at 0x465820
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.004657f0
lea ecx, [ebp - 4]
call fcn.0043ca60
lea ecx, [ebp - 8]
call fcn.0043ca60
push str.360WebDataPv1
lea ecx, [ebp - 8]
call fcn.0043cb20
push ecx
mov ecx, esp
push 0x52aec0
call fcn.0043caa0
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0043ca80
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0043ca80
lea ecx, [ebp - 4]
push ecx
call fcn.0046f030
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4658a5
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.360WebDataTv1
lea ecx, [ebp - 8]
call fcn.0043cb20
push ecx
mov ecx, esp
push 0x52aee8
call fcn.0043caa0
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0043ca80
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0043ca80
lea ecx, [ebp - 4]
push ecx
call fcn.0046f030
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465905
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.privs
lea ecx, [ebp - 8]
call fcn.0043cb20
push ecx
mov ecx, esp
push 0x52af00
call fcn.0043caa0
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0043ca80
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0043ca80
lea ecx, [ebp - 4]
push ecx
call fcn.0046f030
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465965
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.tasks
lea ecx, [ebp - 8]
call fcn.0043cb20
push ecx
mov ecx, esp
push str..dat
call fcn.0043caa0
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0043ca80
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0043ca80
lea ecx, [ebp - 4]
push ecx
call fcn.0046f030
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4659c5
lea ecx, [ebp - 4]
call fcn.0043cc50
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
call fcn.0043cae0
lea ecx, [ebp - 4]
call fcn.0043cae0
lea ecx, [ebp + 8]
call fcn.0043cae0
mov esp, ebp
pop ebp
ret 8
Function at 0x46f030
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp + 0x10]
call fcn.0043cc80
test eax, eax
jne 0x46f05c
push str.360NewCenter
lea ecx, [ebp + 0x10]
call fcn.0043cb20
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp + 0x10]
call fcn.004754b0
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x40e
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.004ed5e0
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x46f0cb
mov dword [ebp - 0x420], 0x80004005
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x420]
jmp 0x46f1e7
mov ecx, dword [ebp + 0xc]
push ecx
push str.360SafeSafeId
lea edx, [ebp - 0x418]
push edx
push 0x52b63c
mov eax, dword [ebp + 8]
push eax
call fcn.0043dc90
add esp, 0x14
mov ecx, dword [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46f145
push 0x52b638
mov ecx, dword [ebp + 8]
call fcn.0043e6d0
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004754b0
mov dword [ebp - 0x424], 1
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x424]
jmp 0x46f1e7
push 0
mov ecx, dword [ebp + 8]
call fcn.0043cc50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x46f1a6
cmp dword [ebp - 0x41c], 0x50
je 0x46f1a6
cmp dword [ebp - 0x41c], 0xb7
je 0x46f1a6
mov dword [ebp - 0x428], 0
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x428]
jmp 0x46f1e7
push 0x52b638
mov ecx, dword [ebp + 8]
call fcn.0043e6d0
lea edx, [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.004754b0
mov dword [ebp - 0x42c], 1
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x46f200
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp + 0x10]
call fcn.0043cc80
test eax, eax
jne 0x46f22c
push str.360NewCenter
lea ecx, [ebp + 0x10]
call fcn.0043cb20
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp + 0x10]
call fcn.004754b0
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x40e
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.004ed5e0
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x418]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x46f29b
mov dword [ebp - 0x420], 0x80004005
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x420]
jmp 0x46f3bc
push 0x52b6a4
mov ecx, dword [ebp + 0xc]
push ecx
push str.360SafeSafeId
lea edx, [ebp - 0x418]
push edx
push 0x52b68c
mov eax, dword [ebp + 8]
push eax
call fcn.0043dc90
add esp, 0x18
mov ecx, dword [ebp + 8]
call fcn.0043cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46f31a
push 0x52b638
mov ecx, dword [ebp + 8]
call fcn.0043e6d0
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004754b0
mov dword [ebp - 0x424], 1
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x424]
jmp 0x46f3bc
push 0
mov ecx, dword [ebp + 8]
call fcn.0043cc50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x46f37b
cmp dword [ebp - 0x41c], 0x50
je 0x46f37b
cmp dword [ebp - 0x41c], 0xb7
je 0x46f37b
mov dword [ebp - 0x428], 0
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x428]
jmp 0x46f3bc
push 0x52b638
mov ecx, dword [ebp + 8]
call fcn.0043e6d0
lea edx, [ebp + 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.004754b0
mov dword [ebp - 0x42c], 1
lea ecx, [ebp + 0xc]
call fcn.0043cae0
lea ecx, [ebp + 0x10]
call fcn.0043cae0
lea ecx, [ebp + 0x14]
call fcn.0043cae0
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret
Function at 0x46f540
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x55930c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x46f569
mov eax, dword [ebp + 8]
push eax
call fcn.0046f720
add esp, 4
test eax, eax
ja 0x46f570
xor eax, eax
jmp 0x46f709
xor ecx, ecx
mov word [ebp - 0x418], cx
push 0x40e
push 0
lea edx, [ebp - 0x416]
push edx
call fcn.004ed5e0
add esp, 0xc
push 0x207
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.004eeac7
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x418]
push eax
call fcn.0046f730
add esp, 4
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x42c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x41c], 0
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, 0x55c668
call fcn.0049bed0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
je 0x46f67b
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x430]
and ecx, 1
je 0x46f642
mov edx, dword [ebp - 0x430]
and edx, 0xfffffffe
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
and eax, 2
je 0x46f65c
mov ecx, dword [ebp - 0x430]
and ecx, 0xfffffffd
mov dword [ebp - 0x430], ecx
mov edx, dword [ebp - 0x430]
cmp edx, dword [ebp - 0x428]
je 0x46f67b
mov eax, dword [ebp - 0x430]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 2
push 0
push 5
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xffffffff
jne 0x46f6b8
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, 0x55c668
call fcn.0049bf80
xor eax, eax
jmp 0x46f709
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jne 0x46f6e5
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x41c]
push ecx
mov ecx, 0x55c668
call fcn.0049bf80
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e9752
mov esp, ebp
pop ebp
ret