joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42eb94
Capabilities:
Delete file
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fe12c
push eax
mov dword fs:[0], esp
sub esp, 0x17c
push ebx
mov ebx, dword [esp + 0x190]
push ebp
push esi
mov esi, ecx
push edi
mov ecx, ebx
call fcn.00456500
mov ebp, dword [ebx + 0x68]
push 0
mov ecx, ebx
call fcn.00456190
push ebx
mov ecx, esi
call fcn.0042db70
mov edi, eax
test edi, edi
jne 0x42ebcf
push 0xec
mov ecx, ebx
call fcn.00456190
mov eax, 0x20
jmp 0x42ed6f
lea ecx, [esp + 0x10]
call fcn.00462140
lea ecx, [esp + 0x174]
mov dword [esp + 0x194], 0
call fcn.0042d100
lea ecx, [esp + 0x188]
mov dword [esp + 0x174], 0x516910
mov dword [esp + 0x178], 0x51690c
mov dword [esp + 0x17c], 0x51691c
mov dword [esp + 0x180], 0x516918
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x10], 0x51688c
mov eax, dword [esi + 0x80]
push str.COLOR
push eax
mov dword [esp + 0x19c], 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
mov ecx, esi
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x184], eax
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0042e070
test eax, eax
jne 0x42ecb6
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
push 0xec
mov ecx, ebx
call fcn.00456190
lea ecx, [esp + 0x188]
mov dword [esp + 0x194], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x194], 0xffffffff
call fcn.00462310
mov eax, 0x20
jmp 0x42ed6f
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
lea ecx, [esp + 0x10]
mov edi, 1
push ecx
push ebx
mov ecx, esi
call fcn.0042e1d0
test eax, eax
jne 0x42ecd6
xor edi, edi
mov edx, dword [esi + 0x84]
lea ecx, [esi + 0x84]
mov eax, dword [edx - 8]
test eax, eax
jne 0x42ecfd
test edi, edi
mov eax, str.SUCCESSED
jne 0x42ecf7
mov eax, str.ERROR
push eax
call fcn.004c8322
push edi
mov ecx, esi
call fcn.0042d7f0
mov eax, dword [ebx + 0x6c]
mov ecx, esi
push eax
call fcn.0042d700
test edi, edi
je 0x42ed32
cmp ebp, 0xbe99d
jne 0x42ed32
mov ecx, dword [ebx + 0x6c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebx + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg edi
sbb edi, edi
and edi, 0xfffff010
add edi, 0x1000
lea ecx, [esp + 0x188]
mov dword [esp + 0x194], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x194], 0xffffffff
call fcn.00462310
mov eax, edi
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x188
ret 4
Function at 0x42f4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 2
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x42f55c
mov edi, 0x542e7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x130]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004c8322
lea esi, [ebx + 0x74]
mov ecx, esi
call sub.MFC42.DLL_CString::Empty
push 0xffffffffffffffff
lea ecx, [ebx + 0x78]
push 0
call fcn.00416000
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 4
call fcn.004c830a
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
push edi
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebx + 0x6c]
lea ecx, [ebp - 0x18]
add eax, 0x90
push eax
call fcn.004c830a
push edi
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_2
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
mov edx, dword [edi]
push ecx
mov ecx, edi
call dword [edx + 0x20]
test eax, eax
jne 0x42f635
mov esi, dword [ebp + 8]
push 0xed
mov ecx, esi
call fcn.00456190
push 0x1000
mov ecx, esi
call fcn.00456180
mov byte [ebp - 4], 2
call sub.MFC42.DLL_AfxTryCleanup
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x14]
mov ecx, esi
push edx
call fcn.004c830a
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push eax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebx + 0x78]
call fcn.00415d90
mov esi, dword [esi]
mov ecx, dword [ebp + 8]
push esi
push edi
push ecx
mov ecx, ebx
call fcn.0042f210
test eax, eax
je 0x42f5f0
mov dword [ebp - 4], 2
call sub.MFC42.DLL_AfxTryCleanup
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe4c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 2
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x43038c
mov edi, 0x542e7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x130]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004c8322
lea esi, [ebx + 0x74]
mov ecx, esi
call sub.MFC42.DLL_CString::Empty
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x78]
call fcn.00416000
push 0xffffffffffffffff
push 0
lea ecx, [ebx + 0x8c]
call fcn.00416000
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 4
call fcn.004c830a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
lea edi, [eax + 0x38]
push edi
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [ebx + 0x6c]
add ecx, 0x90
push ecx
lea ecx, [ebp - 0x18]
call fcn.004c830a
push edi
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_1
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push eax
mov edx, dword [edi]
push ecx
mov ecx, edi
call dword [edx + 0x20]
test eax, eax
jne 0x430475
mov edx, dword [ebp - 0x18]
add ebx, 0xa0
push edx
push 0xed
push ebx
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
mov byte [ebp - 4], 2
call sub.MFC42.DLL_AfxTryCleanup
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.004c830a
mov eax, dword [esi]
mov ecx, ebx
push eax
push edi
call fcn.0042ffa0
test eax, eax
je 0x430430
mov dword [ebp - 4], 2
call sub.MFC42.DLL_AfxTryCleanup
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430510
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fe4db
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0xa0]
mov ecx, ebp
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
push eax
push ebx
mov ecx, esi
call fcn.00430300
test eax, eax
jne 0x430580
mov ecx, dword [esi + 0x74]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ecx
call ebx
mov eax, dword [esi + 0x80]
xor edi, edi
test eax, eax
jle 0x430579
mov edx, dword [esi + 0x7c]
mov eax, dword [edx + edi*4]
push eax
call ebx
mov eax, dword [esi + 0x80]
inc edi
cmp edi, eax
jl 0x430565
xor eax, eax
jmp 0x43062e
push 0x230
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x24], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x18], edi
je 0x4305a4
mov ecx, eax
call fcn.00455d70
mov edi, eax
mov ecx, dword [esi + 0x70]
push edi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00455980
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, edi
call fcn.00455dc0
push 0x106
mov ecx, edi
call fcn.00455430
mov edx, dword [ebx + 0x30]
mov ecx, edi
push edx
call fcn.004555d0
push 0x21
mov ecx, edi
call fcn.00455690
mov eax, dword [esi + 0xa4]
mov dword [esi + 0xa8], 0
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x6c]
push edi
call fcn.004a41e0
test eax, eax
je 0x43062e
mov ecx, dword [esi + 0xa4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esi + 0xa8]
test esi, esi
je 0x430629
push esi
mov ecx, ebp
call sub.MFC42.DLL_CString::LoadStringA
xor eax, eax
jmp 0x43062e
mov eax, 1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8
Function at 0x430e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fe828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x516b38
mov dword [esp + 0x18], 0
lea esi, [edi + 0x680]
mov dword [esp + 0xc], esi
mov dword [esi], 0x515c40
mov eax, dword [esi + 4]
mov byte [esp + 0x18], 8
test eax, eax
je 0x430ec0
mov ecx, dword [esi + 8]
push ecx
push eax
call sub.MFC42.DLL_DestructElements
mov eax, dword [esi + 4]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [edi + 0x67c]
mov dword [esi], 0x514bb8
mov byte [esp + 0x18], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x678]
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CString::CString
lea esi, [edi + 0x664]
mov dword [esp + 0xc], esi
mov dword [esi], 0x515c40
mov eax, dword [esi + 4]
mov byte [esp + 0x18], 9
test eax, eax
je 0x430f18
mov edx, dword [esi + 8]
push edx
push eax
call sub.MFC42.DLL_DestructElements
mov eax, dword [esi + 4]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [edi + 0x660]
mov dword [esi], 0x514bb8
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [edi + 0x65c]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString
lea esi, [edi + 0x648]
mov dword [esp + 0xc], esi
mov dword [esi], 0x5167d0
mov eax, dword [esi + 4]
mov byte [esp + 0x18], 0xa
test eax, eax
je 0x430f63
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi], 0x514bb8
lea esi, [edi + 0x74]
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 0x15
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 0x14
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 0x13
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 0x12
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 0x11
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [esp + 0x18], 0x10
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 0xf
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.0049c160
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4310c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
lea eax, [esp + 0xc]
push eax
call fcn.004eac80
add esp, 4
test eax, eax
jne 0x4310db
mov byte [esp + 0xc], al
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x431112
cmp byte [esp + edx + 0x1c], 0x2e
jne 0x4310ff
mov byte [esp + edx + 0x1c], 0x5f
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x4310f3
lea ecx, [esp + 0x10]
push ecx
call sub.MFC42.DLL_CTime::GetTickCount
mov edi, dword [0x542fec]
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::GetLocalTm
mov ebx, dword [eax]
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::GetLocalTm
mov ebp, dword [eax + 4]
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::GetLocalTm
mov edx, dword [eax + 8]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
call sub.MFC42.DLL_CTime::GetLocalTm
mov eax, dword [eax + 0xc]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_CTime::GetLocalTm
mov esi, dword [eax + 0x10]
push 0
lea ecx, [esp + 0x14]
inc esi
call sub.MFC42.DLL_CTime::GetLocalTm
mov eax, dword [eax + 0x14]
mov edx, dword [0x542fec]
mov ecx, dword [esp + 0x22c]
add eax, 0x76c
inc edx
push edi
mov dword [0x542fec], edx
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x234]
push ebp
push ecx
push edx
push esi
push eax
push str._04d_02d_02d__02d_02d_02d__s__ld__ld.PRN
push ebx
call sub.MFC42.DLL_CString::Format
add esp, 0x2c
lea eax, [esp + 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4311ff
mov edi, 0x542e7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x11c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x228]
lea ecx, [esp + 0x11c]
push ecx
mov ecx, esi
call fcn.004c8322
push ebx
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret 0xc
Function at 0x43bcd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5002b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004c84b4
mov eax, dword [esp + 0x2c]
push 0
push 0x8040
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x43bd3c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CFile::GetLength
mov ebx, dword [esp + 0x34]
mov esi, eax
mov eax, dword [ebx]
test eax, eax
jbe 0x43bd57
cmp esi, eax
jbe 0x43bd57
mov esi, eax
push esi
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x34]
add esp, 4
lea ecx, [esp + 0xc]
push esi
push eax
mov dword [edi], eax
call sub.MFC42.DLL_CFile::Read
cmp eax, esi
je 0x43bdb6
mov eax, dword [edi]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0xc]
mov dword [edi], 0
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [ebx], esi
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CFile::CFile
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x43c22c
Capabilities:
Get common file path
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x500351
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
mov esi, ecx
mov ebx, 1
cmp dword [esi + 0x7c], ebx
je 0x43c240
mov eax, ebx
jmp 0x43c371
lea eax, [esp + 0x20]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov dword [esp + 0x130], 0
call sub.MFC42.DLL_CString::CString_3
mov edi, dword [esp + 0x138]
lea ecx, [esp + 0x24]
push edi
push ecx
lea edx, [esp + 0x14]
push str._sLD_d.t01
push edx
mov byte [esp + 0x140], bl
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea eax, [esp + 0x24]
lea ecx, [esp + 0x10]
push edi
push eax
push str._sLD_d.tmp
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x14]
call fcn.004c84b4
mov edx, dword [esp + 0xc]
push 0
push 0x9001
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x13c], 2
call sub.MFC42.DLL_CFile::Open
test eax, eax
pop edi
je 0x43c33a
mov eax, dword [esi + 0x78]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFile::Close
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, ebx
jmp 0x43c371
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x12c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x124]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret 4
Function at 0x449290
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x503a93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [edi + 0x6c]
xor ebp, ebp
mov dword [esp + 0x28], ebp
mov ecx, dword [eax + 0x110]
cmp ecx, ebp
jle 0x449458
push ebx
push esi
mov bl, 2
mov eax, dword [eax + 0x10c]
mov edx, dword [edi]
lea ecx, [esp + 0x14]
mov eax, dword [eax + ebp*4]
push ecx
push eax
mov ecx, edi
call dword [edx + 0xac]
test eax, eax
je 0x449446
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x449446
mov ecx, dword [edi + 0x6c]
mov eax, dword [ecx + 0xc4]
test eax, eax
jne 0x449446
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString_3
lea edx, [esp + 0x10]
mov byte [esp + 0x30], bl
push edx
call fcn.004552b0
push 0x230
call sub.MFC42.DLL_operatornew
add esp, 8
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x30], 3
je 0x449366
mov ecx, eax
call fcn.00455d70
mov esi, eax
jmp 0x449368
xor esi, esi
mov ecx, dword [edi + 0x70]
push esi
mov byte [esp + 0x34], bl
call fcn.00455980
mov eax, dword [edi + 0x70]
lea ecx, [esp + 0x18]
add eax, 0xdc
push eax
call fcn.004c8322
mov eax, dword [esp + 0x18]
mov ecx, esi
push eax
call fcn.00455550
mov ecx, dword [edi + 0x6c]
mov edx, dword [ecx + 0x10c]
mov ecx, esi
mov eax, dword [edx + ebp*4]
push eax
call fcn.004555d0
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.00455490
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00455450
push 1
mov ecx, esi
call fcn.00455430
push 0xbe99d
mov ecx, esi
call fcn.00455690
push 0x5416d4
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x14]
mov byte [esp + 0x30], 4
push edx
push eax
lea eax, [esp + 0x24]
push eax
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x34], 5
call fcn.00455dc0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [edi + 0x6c]
push esi
call fcn.004a41e0
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call sub.MFC42.DLL_CString::CString
mov eax, dword [edi + 0x6c]
inc ebp
cmp ebp, dword [eax + 0x110]
jl 0x4492d0
pop esi
pop ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 4