joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408cf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00408490
push dword [esi + 0x40]
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.0044ac9e
mov ebx, dword [esp + 0x14]
push 2
push 0
push ebx
mov dword [esi + 0x40], 0
call fcn.0044a481
push ebx
call fcn.0044a859
push 0
push 0
push ebx
mov edi, eax
call fcn.0044a481
add esp, 0x20
test edi, edi
je 0x408dd2
lea eax, [edi + 1]
push eax
call fcn.004485e4
push ebx
push edi
push 1
push eax
mov dword [esi + 0x40], eax
call fcn.0044b349
add esp, 0x14
cmp eax, edi
je 0x408d86
pop edi
mov dword [esi + 0x30], 5
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
pop esi
mov eax, 5
pop ebx
ret 4
mov eax, dword [esi + 0x40]
mov byte [edi + eax], 0
push dword [esi + 0x40]
call fcn.00409c60
mov ecx, eax
add esp, 4
mov byte [esi + 0x2c], 0
cmp byte [ecx], 0xef
jne 0x408db6
cmp byte [ecx + 1], 0xbb
jne 0x408db6
cmp byte [ecx + 2], 0xbf
jne 0x408db6
mov byte [esi + 0x2c], 1
add ecx, 3
test ecx, ecx
je 0x408dd2
cmp byte [ecx], 0
je 0x408dd2
mov eax, dword [esi]
push 0
push ecx
mov ecx, esi
call dword [eax + 0x3c]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebx
ret 4
mov eax, 0xf
pop edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
pop esi
pop ebx
ret 4
Function at 0x40c5b0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x468ff6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebx
push esi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call fcn.004129b0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x40c5fe
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp dword [esp + 0x24], 8
jb 0x40c61d
push dword [esp + 0x10]
call fcn.00449096
add esp, 4
test bl, bl
je 0x40c628
mov al, 1
jmp 0x40c787
push 0x208
lea eax, [esp + 0x44]
push 0
push eax
call fcn.0044ae30
lea eax, [esp + 0x1c]
push eax
call fcn.004129b0
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40c64e
mov eax, dword [eax]
push eax
push 0x104
lea eax, [esp + 0x48]
push eax
push 0x46bdfc
push str.check_for_updates
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esp + 0x24], 8
jb 0x40c681
push dword [esp + 0x10]
call fcn.00449096
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
cmp word [esp + 0x40], ax
jne 0x40c6a3
xor ecx, ecx
jmp 0x40c6bf
lea ecx, [esp + 0x40]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c6b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x30]
call fcn.00401b70
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x38]
push dword [esp + 0xc]
lea ecx, [esp + 0x2c]
cmovae ecx, dword [esp + 0x2c]
mov dword [esp + 0x258], 0
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x2c]
cmovae ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.0040a0d0
cmp dword [esp + 0x24], 0x10
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x10]
cmovae ecx, dword [esp + 0x10]
mov eax, 1
cmp esi, eax
cmovb eax, esi
push eax
push 0x46be74
push ecx
call fcn.00404f90
add esp, 0xc
test eax, eax
jne 0x40c75d
cmp esi, 1
jb 0x40c75d
cmp esi, 1
setne al
test eax, eax
jne 0x40c75d
mov bl, 1
jmp 0x40c75f
xor bl, bl
cmp dword [esp + 0x24], 0x10
jb 0x40c772
push dword [esp + 0x10]
call fcn.00449096
add esp, 4
cmp dword [esp + 0x3c], 8
jb 0x40c785
push dword [esp + 0x28]
call fcn.00449096
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.00449824
add esp, 0x24c
ret
Function at 0x40c7b0
Capabilities:
Encrypt data using dpapi

Disassembly:
sub esp, 0x38
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x40]
push esi
mov eax, dword [ecx + 0x10]
mov esi, dword [esp + 0x40]
inc eax
cmp dword [ecx + 0x14], 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 4], eax
jb 0x40c7df
mov ecx, dword [ecx]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], str.55A4__B0_8EE8_4AA9_AB1F_20C__5B65E___F__YWD2DB_4585_9778_146____F0487
mov dword [esp + 0x30], 0x53
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x40c86a
push dword [esp + 0xc]
lea ecx, [esp + 0x24]
push dword [esp + 0x14]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
call fcn.00401950
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00402d50
cmp dword [esp + 0x34], 0x10
jb 0x40c889
push dword [esp + 0x20]
call fcn.00449096
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00449824
add esp, 0x38
ret
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x46b630
mov ecx, esi
mov byte [esi], 0
call fcn.00401950
mov ecx, dword [esp + 0x38]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00449824
add esp, 0x38
ret
Function at 0x40ef70
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x46931b
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x258], eax
push ebx
push edi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0x268]
mov dword fs:[0], eax
mov edi, dword [esp + 0x278]
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x10], 0
call fcn.004129b0
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x40efcd
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp dword [esp + 0x58], 8
jb 0x40efec
push dword [esp + 0x44]
call fcn.00449096
add esp, 4
test bl, bl
je 0x40f014
push 0x34
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push str.http:__emsfs.autodesk.com_utility_wingman_update.xml
mov ecx, edi
mov byte [edi], 0
call fcn.00401950
jmp 0x40f148
push 0x208
lea eax, [esp + 0x60]
push 0
push eax
call fcn.0044ae30
lea eax, [esp + 0x50]
push eax
call fcn.004129b0
add esp, 0x10
cmp dword [eax + 0x14], 8
jb 0x40f03a
mov eax, dword [eax]
push eax
push 0x104
lea eax, [esp + 0x64]
push eax
push 0x46bdfc
push 0x46be48
push str.Update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [esp + 0x58], 8
jb 0x40f06d
push dword [esp + 0x44]
call fcn.00449096
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
cmp word [esp + 0x5c], ax
jne 0x40f08f
xor ecx, ecx
jmp 0x40f0a5
lea ecx, [esp + 0x5c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f096
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
call fcn.00401b70
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x24]
push dword [esp + 0x10]
lea ecx, [esp + 0x18]
cmovae ecx, dword [esp + 0x18]
mov dword [esp + 0x274], 0
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x18]
cmovae ecx, dword [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
call fcn.0040a0d0
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
call fcn.00402d50
cmp dword [esp + 0x40], 0x10
jb 0x40f120
push dword [esp + 0x2c]
call fcn.00449096
add esp, 4
cmp dword [esp + 0x28], 8
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x40f148
push dword [esp + 0x14]
call fcn.00449096
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x268]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.00449824
add esp, 0x268
ret
Function at 0x411f00
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4697f3
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
push edi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0xd8]
mov dword fs:[0], eax
push str._SERVICEIDLEMUTEX_A3A77257_3372_46E4_A810_1E4989309A95
call fcn.00415040
add esp, 4
test eax, eax
jne 0x41201a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push 1
push 2
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00402bc0
mov dword [esp + 0xe0], 0
cmp esi, 2
jne 0x411f80
push str.Service_mutex_not_found._r_n
lea eax, [esp + 0x10]
jmp 0x411fa1
push 0x46b7dc
call edi
push eax
lea eax, [esp + 0x14]
push str.Unable_to_open_service_mutex._Error:
push eax
call fcn.00402210
add esp, 8
mov ecx, eax
call fcn.00411110
push eax
call fcn.00402210
add esp, 8
call fcn.00413330
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x10]
call fcn.00407040
push eax
mov byte [esp + 0xe4], 1
call fcn.004133a0
add esp, 4
cmp dword [esp + 0xb8], 0x10
jb 0x411fea
push dword [esp + 0xa4]
call fcn.00449096
add esp, 4
lea ecx, [esp + 0x5c]
mov dword [esp + 0xe0], 0xffffffff
call fcn.004032c0
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x60], vtable.std::ios_base.0
call fcn.00448ca0
add esp, 4
xor al, al
jmp 0x4120c9
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push str._UPDATERDOWNLOADCOMPLETEMUTEX_E8A1D1F8_0A1C_4F86_9BCF_C65A1BDD3226
call fcn.00414c90
mov edi, eax
add esp, 4
test edi, edi
jne 0x41207d
call fcn.00413330
push str.Unable_to_create_download_complete_mutex._r_n
lea ecx, [esp + 0xa8]
call fcn.00401000
push eax
mov dword [esp + 0xe4], 2
call fcn.004133a0
add esp, 4
cmp dword [esp + 0xb8], 0x10
jb 0x412079
push dword [esp + 0xa4]
call fcn.00449096
add esp, 4
xor al, al
jmp 0x4120c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4120c7
call fcn.00413330
push str.The_download_complete_mutex_already_exists._Quiting._r_n
lea ecx, [esp + 0xc0]
call fcn.00401000
push eax
mov dword [esp + 0xe4], 3
call fcn.004133a0
add esp, 4
lea ecx, [esp + 0xbc]
call fcn.004010b0
push edi
call esi
xor al, al
jmp 0x4120c9
mov al, 1
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00449824
add esp, 0xd8
ret
Function at 0x4120f0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x204
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0044ae30
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4121c7
push str.AdAppMgrUpdater_
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412173
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.AdApplicationManager_installer.exe
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [esp + 8], ax
jne 0x4121a7
xor ecx, ecx
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x4121e0
lea ecx, [esp + 8]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4121b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x4121e0
xor eax, eax
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push 0x46bdfc
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00449824
add esp, 0x210
ret
Function at 0x412520
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4698ab
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x248], eax
push edi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0x254]
mov dword fs:[0], eax
mov edi, dword [esp + 0x264]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREAutodeskAutodesk_Application_Manager
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4126b1
push 0x208
push eax
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0x400
call fcn.0044ae30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.Version
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
cmp word [esp + 0x48], ax
je 0x412602
lea eax, [esp + 0x48]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4125f3
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.00401b70
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x28]
push dword [esp + 8]
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
mov dword [esp + 0x260], 0
lea eax, [ecx + eax*2]
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], 0
mov byte [esp + 0x3c], 0
call fcn.0040a0d0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.00402d50
cmp dword [esp + 0x44], 0x10
jb 0x412687
push dword [esp + 0x30]
call fcn.00449096
add esp, 4
cmp dword [esp + 0x2c], 8
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
jb 0x4126d0
push dword [esp + 0x18]
call fcn.00449096
add esp, 4
jmp 0x4126d0
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push 0x46b630
mov ecx, edi
mov byte [edi], 0
call fcn.00401950
mov eax, edi
mov ecx, dword [esp + 0x254]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.00449824
add esp, 0x258
ret
Function at 0x412700
Capabilities:
Access peb ldr_data
Check if file exists
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4698e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x46cd9c
mov dword [esp + 0x20], 0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x412782
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0x46bdfc
mov ecx, esi
mov word [esi], ax
call fcn.00401b70
jmp 0x412877
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov edx, dword [esp + 0xc]
mov dword [esp + 0x38], eax
cmp word [edx], ax
jne 0x4127aa
xor ecx, ecx
jmp 0x4127bf
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4127b0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00401b70
push 9
push str.Autodesk
lea ecx, [esp + 0x1c]
call fcn.0040c050
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41280c
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push 0
push eax
call edi
push 0x10
push str.AdAppMgrUpdater
lea ecx, [esp + 0x1c]
call fcn.0040c050
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412848
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push 0
push eax
call edi
push 0x14
push str.AdAppMgrUpdater.log
lea ecx, [esp + 0x1c]
call fcn.0040c050
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0040a7c0
cmp dword [esp + 0x28], 8
jb 0x412877
push dword [esp + 0x14]
call fcn.00449096
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00449824
add esp, 0x30
ret
Function at 0x4128a0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x204
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0044ae30
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x412977
push str.AdAppMgrUpdater_
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412923
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.AdAppMgrUpdater.log
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [esp + 8], ax
jne 0x412957
xor ecx, ecx
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x412990
lea ecx, [esp + 8]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412960
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x412990
xor eax, eax
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push 0x46bdfc
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00449824
add esp, 0x210
ret

Function at 0x412a90
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push 0x204
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0044ae30
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x412b67
push str.AdAppMgrUpdater_
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412b13
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.update.xml
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [esp + 8], ax
jne 0x412b47
xor ecx, ecx
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x412b80
lea ecx, [esp + 8]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412b50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0xc]
push eax
jmp 0x412b80
xor eax, eax
push eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push 0x46bdfc
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00449824
add esp, 0x210
ret
Function at 0x413000
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4699b6
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
push str._SERVICEIDLEMUTEX_A3A77257_3372_46E4_A810_1E4989309A95
call fcn.00415040
mov esi, eax
add esp, 4
test esi, esi
jne 0x4130d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 2
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00402bc0
mov dword [esp + 0xdc], 0
cmp esi, 2
jne 0x41307f
push str.Service_mutex_not_found._r_n
lea eax, [esp + 0xc]
jmp 0x4130a4
push 0x46b7dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.Unable_to_open_service_mutex._Error:
push eax
call fcn.00402210
add esp, 8
mov ecx, eax
call fcn.00411110
push eax
call fcn.00402210
add esp, 8
call fcn.00413330
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xc]
call fcn.00407040
mov byte [esp + 0xdc], 1
jmp 0x41320f
call fcn.00413330
push 0x24
push str.Wating_for_service_to_become_idle._r_n
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd4], 0xf
mov dword [esp + 0xd0], 0
mov byte [esp + 0xc0], 0
call fcn.00401950
lea eax, [esp + 0xb8]
push eax
mov dword [esp + 0xe0], 2
call fcn.00413450
add esp, 4
cmp dword [esp + 0xcc], 0x10
mov dword [esp + 0xdc], 0xffffffff
jb 0x413145
push dword [esp + 0xb8]
call fcn.00449096
add esp, 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x4131ab
cmp eax, 0x80
je 0x4131ab
call fcn.00413330
push str.Wait_finished._Service_is_idle_now._r_n
lea ecx, [esp + 0xa4]
call fcn.00401000
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xe0], 5
call fcn.00413450
add esp, 4
cmp dword [esp + 0xb4], 0x10
jb 0x4131a4
push dword [esp + 0xa0]
call fcn.00449096
add esp, 4
mov al, 1
jmp 0x41325c
push 1
push 2
lea ecx, [esp + 0x10]
call fcn.00402bc0
push 0x46b7dc
mov dword [esp + 0xe0], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push str.Wait_failed_on_service_mutex__or_DDS_has_died._Error:
push eax
call fcn.00402210
add esp, 8
mov ecx, eax
call fcn.00411110
push eax
call fcn.00402210
add esp, 8
call fcn.00413330
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xc]
call fcn.00407040
mov byte [esp + 0xdc], 4
push eax
call fcn.004133a0
add esp, 4
cmp dword [esp + 0xb4], 0x10
jb 0x413231
push dword [esp + 0xa0]
call fcn.00449096
add esp, 4
lea ecx, [esp + 0x58]
mov dword [esp + 0xdc], 0xffffffff
call fcn.004032c0
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], vtable.std::ios_base.0
call fcn.00448ca0
add esp, 4
xor al, al
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.00449824
add esp, 0xd8
ret
Function at 0x413450
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x469a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x481b08]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
mov eax, dword [0x481b08]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, dword [esp + 0xb0]
push 0
call fcn.0044c689
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x14], edx
call fcn.0044c3ec
add esp, 8
test eax, eax
je 0x4134e1
movq xmm0, qword [eax]
movq qword [esp + 0x28], xmm0
movq xmm0, qword [eax + 8]
movq qword [esp + 0x30], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x38], xmm0
movq xmm0, qword [eax + 0x18]
movq qword [esp + 0x40], xmm0
mov eax, dword [eax + 0x20]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x28]
push eax
push str._Y__m__d__X
lea eax, [esp + 0x54]
push 0x50
push eax
call fcn.0044c3cf
add esp, 0x10
cmp byte [esp + 0x4c], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jne 0x41351a
xor ecx, ecx
jmp 0x41352a
lea ecx, [esp + 0x4c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413521
sub ecx, edx
push ecx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
call fcn.00401950
push 0xffffffffffffffff
push 0
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb4], 0
call fcn.00404a00
mov ecx, dword [0x483040]
test ecx, ecx
je 0x413585
cmp dword [esp + 0x24], 0x10
push ecx
push dword [esp + 0x24]
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push 1
push eax
call fcn.0044aa18
push dword [0x483040]
call fcn.0044c175
add esp, 0x14
mov ecx, dword [0x483044]
test ecx, ecx
je 0x4135b8
cmp dword [esp + 0x24], 0x10
push ecx
push dword [esp + 0x24]
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push 1
push eax
call fcn.0044aa18
push dword [0x483044]
call fcn.0044c175
add esp, 0x14
cmp dword [esp + 0x24], 0x10
jb 0x4135cb
push dword [esp + 0x10]
call fcn.00449096
add esp, 4
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00449824
add esp, 0xa4
ret