joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443b1e
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push 0x114
mov eax, 0x47370c
call fcn.00459c76
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x54]
mov edi, ecx
call fcn.0043bdc9
xor ebx, ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0043bdc9
lea esi, [ebp - 0x10c]
mov byte [ebp - 4], 1
call fcn.00441ad6
mov byte [ebp - 4], 2
push edi
mov dword [ebp - 0x118], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x60]
push str.res:__res.zip
push eax
mov byte [ebp - 4], 3
call fcn.004095cb
push dword [ebp - 0x110]
lea eax, [edi + 0x80]
push eax
call fcn.004095cb
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [ebp + 0xc]
push 0x4868ac
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x443cd9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x118], eax
cmp eax, ebx
je 0x443cd9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x120], eax
cmp eax, ebx
je 0x443cbf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push eax
mov dword [ebp - 0x11c], eax
call fcn.00441bbd
mov esi, dword [ebp - 0x110]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x443c2b
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.004420ce
pop ecx
pop ecx
mov dword [ebp - 0x110], eax
cmp eax, ebx
je 0x443c2b
cmp eax, 0xfffffffa
jne 0x443ccb
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00447e69
mov ecx, dword [ebp - 0x30]
add esp, 0xc
cmp dword [ebp - 0x1c], 8
jae 0x443c48
lea ecx, [ebp - 0x30]
call fcn.00448625
mov dword [ebp - 0x110], eax
cmp eax, ebx
jne 0x443ccb
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x443cbf
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x443c9e
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x11c]
je 0x443caa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
push ebx
push dword [ebp - 0x114]
call fcn.00441c2b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x443ccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x443ce5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
lea esi, [ebp - 0x10c]
mov byte [ebp - 4], 1
call fcn.0043dee5
lea eax, [ebp - 0x34]
call fcn.0043b39a
lea eax, [ebp - 0x54]
call fcn.0043b39a
mov eax, dword [ebp - 0x110]
call fcn.00459cf9
ret
Function at 0x443d7e
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push 0x114
mov eax, 0x47370c
call fcn.00459c76
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x54]
mov edi, ecx
call fcn.0043bdc9
xor ebx, ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0043bdc9
lea esi, [ebp - 0x10c]
mov byte [ebp - 4], 1
call fcn.00441ad6
mov byte [ebp - 4], 2
push edi
mov dword [ebp - 0x118], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x60]
push str.res:__res.zip
push eax
mov byte [ebp - 4], 3
call fcn.004095cb
push dword [ebp - 0x110]
lea eax, [edi + 0x80]
push eax
call fcn.004095cb
push edi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [ebp + 0xc]
push 0x4868d8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x443f39
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x118], eax
cmp eax, ebx
je 0x443f39
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x120], eax
cmp eax, ebx
je 0x443f1f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push eax
mov dword [ebp - 0x11c], eax
call fcn.00441bbd
mov esi, dword [ebp - 0x110]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x443e8b
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.004420ce
pop ecx
pop ecx
mov dword [ebp - 0x110], eax
cmp eax, ebx
je 0x443e8b
cmp eax, 0xfffffffa
jne 0x443f2b
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00447e69
mov ecx, dword [ebp - 0x30]
add esp, 0xc
cmp dword [ebp - 0x1c], 8
jae 0x443ea8
lea ecx, [ebp - 0x30]
call fcn.00448625
mov dword [ebp - 0x110], eax
cmp eax, ebx
jne 0x443f2b
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x443f1f
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x443efe
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x11c]
je 0x443f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
push ebx
push dword [ebp - 0x114]
call fcn.00441c2b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x443f2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x443f45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
lea esi, [ebp - 0x10c]
mov byte [ebp - 4], 1
call fcn.0043dee5
lea eax, [ebp - 0x34]
call fcn.0043b39a
lea eax, [ebp - 0x54]
call fcn.0043b39a
mov eax, dword [ebp - 0x110]
call fcn.00459cf9
ret
Function at 0x445e92
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4727d9
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
push 0x485ed8
lea eax, [esp + 0x28]
call fcn.0043bde9
and dword [esp + 0xb0], 0
lea eax, [esp + 0x24]
lea ebx, [esi + 0x24]
push eax
call fcn.0043be60
or dword [esp + 0xb0], 0xffffffff
mov edi, eax
lea eax, [esp + 0x24]
call fcn.0043b39a
push 0x486bcc
lea eax, [esp + 0x68]
call fcn.0043bde9
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0xb4], 1
call fcn.0043be60
or dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x64]
call fcn.0043b39a
push 0x486bd8
lea eax, [esp + 0x48]
call fcn.0043bde9
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0xb4], 2
call fcn.0043be60
or dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [esp + 0x44]
call fcn.0043b39a
push 0x4869f0
lea eax, [esp + 0x88]
call fcn.0043bde9
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0xb4], 3
call fcn.0043be60
or dword [esp + 0xb0], 0xffffffff
mov ebx, eax
lea eax, [esp + 0x84]
call fcn.0043b39a
xor eax, eax
cmp dword [edi + 0x14], eax
je 0x4460c0
mov dword [esp + 0x20], eax
cmp dword [ebx + 0x14], eax
je 0x445fdc
cmp dword [ebx + 0x18], 8
jb 0x445fce
mov ebx, dword [ebx + 4]
jmp 0x445fd1
add ebx, 4
push ebx
call fcn.00455cf0
pop ecx
mov dword [esp + 0x20], eax
mov esi, dword [esi + 0x8c]
mov eax, dword [esp + 0x1c]
add esi, 0x188
cmp dword [eax + 0x18], 8
jb 0x445ffd
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [eax]
jmp 0x446004
add eax, 4
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], 8
lea ebx, [edi + 4]
jb 0x446011
mov ecx, dword [ebx]
jmp 0x446013
mov ecx, ebx
push eax
push ecx
push 7
call fcn.00441cd3
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x446029
mov eax, dword [ebx]
jmp 0x44602b
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4460a8
cmp dword [edi + 0x18], 8
jb 0x446040
mov eax, dword [ebx]
jmp 0x446042
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4460a8
mov esi, dword [esp + 0x20]
cmp esi, 0xffffffff
jne 0x446058
or esi, esi
push dword [esp + 0x10]
mov eax, str.true
call fcn.0043ca77
neg eax
sbb al, al
inc al
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 8
mov eax, dword [esp + 0x14]
jb 0x446080
mov eax, dword [eax]
cmp dword [edi + 0x18], 8
jb 0x44608a
mov ecx, dword [ebx]
jmp 0x44608c
mov ecx, ebx
push 0
push dword [esp + 0x14]
push esi
push eax
call fcn.00448bad
mov ecx, dword [esp + 0x28]
add esp, 0x10
mov dword [ecx + 0x80], eax
jmp 0x4460b6
mov eax, dword [esp + 0x18]
mov dword [eax + 0x80], 2
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x80]
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446651
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47360b
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4a0590]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x14], esi
call fcn.0043bdc9
and dword [esp + 0x78], 0
push 0x485ed8
lea eax, [esp + 0x2c]
call fcn.0043bde9
lea eax, [esp + 0x28]
push eax
lea ebx, [esi + 0x24]
mov byte [esp + 0x7c], 1
call fcn.0043be60
mov edi, eax
lea eax, [esp + 0x28]
mov byte [esp + 0x78], 0
call fcn.0043b39a
cmp dword [edi + 0x14], 0
jne 0x4466fd
xor esi, esi
lea eax, [esp + 0x48]
call fcn.0043b39a
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00453655
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 8
jb 0x446708
mov edi, dword [edi + 4]
jmp 0x44670b
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, 0x486028
je 0x446721
mov eax, 0x48602c
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.004095cb
mov eax, dword [esi + 0x78]
mov eax, dword [eax]
mov ecx, dword [esi + 0x64]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x78]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x64]
lea edi, [esp + 0x20]
lea esi, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.0040bec1
test al, al
je 0x446794
call fcn.0044a28c
mov eax, dword [eax]
add eax, 4
push eax
lea eax, [esp + 0x4c]
call fcn.00446d2d
test al, al
jne 0x44677e
call fcn.0043da00
mov esi, dword [esp + 0x14]
jmp 0x44673c
call fcn.0044a28c
mov eax, dword [eax]
call fcn.004445a9
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x80], eax
mov eax, dword [esp + 0x14]
mov esi, dword [eax + 0x80]
jmp 0x4466d4
Function at 0x447b6c
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00463310
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0xffe
mov word [ebp - 0x1004], ax
xor ebx, ebx
lea eax, [ebp - 0x1002]
push ebx
push eax
call fcn.0045f360
push edi
mov esi, 0x800
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00455d11
push 0x47ef98
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00455d80
add esp, 0x24
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x447be5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x447be5
xor al, al
jmp 0x447c1b
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x447be1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00453655
leave
ret
Function at 0x447f63
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x870
mov eax, 0x471a5c
call fcn.00459c76
mov eax, dword [ebp + 8]
and dword [ebp - 0x87c], 0
mov edi, ecx
mov dword [ebp - 0x874], eax
lea eax, [ebp - 0x850]
mov dword [ebp - 0x878], edi
mov esi, edx
call fcn.0043bdc9
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x870]
mov dword [ebp - 4], ebx
call fcn.0043bdc9
mov eax, edi
call fcn.0043bdc9
lea eax, [ebp - 0x830]
mov dword [ebp - 0x87c], ebx
call fcn.0043bdc9
xor eax, eax
mov byte [ebp - 4], 3
push 0x7fe
mov word [ebp - 0x810], ax
xor edi, edi
lea eax, [ebp - 0x80e]
push edi
push eax
call fcn.0045f360
add esp, 0xc
cmp esi, edi
je 0x447fed
cmp word [esi], di
jne 0x447ff2
mov esi, str.tempfile
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.004095cb
mov eax, dword [ebp - 0x874]
cmp eax, edi
je 0x44801d
cmp word [eax], di
je 0x44801d
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.004095cb
jmp 0x448057
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x448038
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x810]
lea esi, [ebp - 0x850]
call fcn.00409639
lea edi, [ebp - 0x850]
lea esi, [ebp - 0x830]
call fcn.0043ba47
push 0x5c
call fcn.0040c1c7
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x870]
call fcn.0040cb6f
push str..tmp
mov eax, esi
push eax
call fcn.0040baa6
and dword [ebp - 0x874], 0
mov ebx, 0x2710
mov esi, dword [ebp - 0x878]
lea edi, [ebp - 0x830]
call fcn.0043ba47
push dword [ebp - 0x874]
lea eax, [ebp - 0x810]
push 0x485d0c
push 0x400
push eax
call fcn.00455b9a
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
push esi
call fcn.0040baa6
cmp dword [esi + 0x18], 8
jb 0x4480df
mov eax, dword [esi + 4]
jmp 0x4480e2
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4480fc
inc dword [ebp - 0x874]
cmp dword [ebp - 0x874], ebx
jl 0x448097
cmp dword [ebp - 0x874], ebx
jne 0x44810b
mov eax, esi
call fcn.0040bacf
lea eax, [ebp - 0x830]
call fcn.0043b39a
lea eax, [ebp - 0x870]
call fcn.0043b39a
lea eax, [ebp - 0x850]
call fcn.0043b39a
mov eax, esi
call fcn.00459cf9
ret
Function at 0x4483f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47274e
mov eax, dword fs:[0]
push eax
mov eax, 0x1228
call fcn.00463310
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x54
mov dword [ebp - 0x122c], eax
pop ecx
xor ebx, ebx
mov esi, str._ECHO_OFF_r_n_t_t_t_t_t_t_t_t_t:REPEAT_r_n_t_t_t_t_t_t_t_t_tDEL___s__r_n_t_t_t_t_t_t_t_t_tCHOICE__C:AB__D:A__T_1___NUL_r_n_t_t_t_t_t_t_t_t_tIF_EXIST___s__GOTO_REPEAT_r_n_t_t_t_t_t_t_t_t_tRD__S__Q___s__r_n_t_t_t_t_t_t_t_t_tDEL____0__r_n
lea edi, [ebp - 0x164]
lea eax, [ebp - 0x11c4]
mov dword [ebp - 0x1228], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0043bdc9
lea eax, [ebp - 0x11e4]
mov dword [ebp - 4], ebx
call fcn.0043bdc9
lea eax, [ebp - 0x1204]
call fcn.0043bdc9
lea eax, [ebp - 0x1224]
call fcn.0043bdc9
lea eax, [ebp - 0x11a4]
call fcn.0043bdc9
push 0x410
lea eax, [ebp - 0x984]
push eax
push ebx
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4485c2
lea eax, [ebp - 0x984]
push eax
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0x11e4]
push eax
call fcn.00447e69
add esp, 0xc
push dword [ebp - 0x122c]
lea eax, [ebp - 0x97e]
push eax
lea eax, [ebp - 0x984]
push eax
lea edi, [ebp - 0x11a4]
call fcn.0044a776
push str.cleaner.bat
mov eax, edi
push eax
call fcn.0040baa6
cmp dword [ebp - 0x118c], 8
mov eax, dword [ebp - 0x11a0]
jae 0x448500
lea eax, [ebp - 0x11a0]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44858a
push dword [ebp - 0x122c]
lea eax, [ebp - 0x984]
push eax
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x1184]
push 0x400
push eax
call fcn.00455b9a
lea eax, [ebp - 0x1184]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x44854c
push ebx
sub eax, edx
lea ecx, [ebp - 0x1230]
push ecx
sar eax, 1
push eax
lea eax, [ebp - 0x1184]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x448581
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1228], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448596
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], ebx
jne 0x4485ce
cmp dword [ebp - 0x118c], 8
mov ecx, dword [ebp - 0x11a0]
jae 0x4485b3
lea ecx, [ebp - 0x11a0]
push ebx
push 1
push ebx
push ebx
call fcn.00448bad
add esp, 0x10
jmp 0x4485c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1228], eax
lea eax, [ebp - 0x11a4]
call fcn.0043b39a
lea eax, [ebp - 0x1224]
call fcn.0043b39a
lea eax, [ebp - 0x1204]
call fcn.0043b39a
lea eax, [ebp - 0x11e4]
call fcn.0043b39a
lea eax, [ebp - 0x11c4]
call fcn.0043b39a
mov eax, dword [ebp - 0x1228]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00453655
leave
ret
Function at 0x448625
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push 0x86c
mov eax, 0x473497
call fcn.00459c76
lea eax, [ebp - 0x878]
push eax
mov ebx, ecx
call fcn.0044a1ab
xor edi, edi
lea eax, [ebp - 0x854]
mov dword [ebp - 4], edi
call fcn.0043bdc9
lea eax, [ebp - 0x834]
call fcn.0043bdc9
mov byte [ebp - 4], 2
cmp ebx, edi
je 0x44881f
cmp word [ebx], di
je 0x44881f
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4486b2
and eax, 0x10
cmp al, 0x10
jne 0x4486ad
lea eax, [ebp - 0x834]
call fcn.0043b39a
lea eax, [ebp - 0x854]
call fcn.0043b39a
lea esi, [ebp - 0x878]
call fcn.0044a1e8
mov eax, edi
jmp 0x448842
call fcn.00448382
xor eax, eax
push 0x7fe
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x812]
push edi
push eax
call fcn.0045f360
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x44870e
lea eax, [ebp - 0x814]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4486ef
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x814]
lea esi, [ebp - 0x854]
call fcn.00409639
mov esi, ebx
call fcn.00447b3b
mov edx, eax
lea ecx, [ebp - 0x878]
call fcn.0044a6cb
mov eax, dword [ebp - 0x864]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x878]
push 4
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x858], eax
pop eax
mov ecx, 0x486720
lea esi, [ebp - 0x834]
call fcn.00409639
mov eax, ebx
call fcn.00447cda
test al, al
je 0x448778
lea esi, [ebp - 0x85c]
call fcn.0044a28c
push 0xffffffffffffffff
push edi
lea esi, [ebp - 0x834]
call fcn.0040cb6f
jmp 0x448808
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x854]
lea esi, [ebp - 0x834]
call fcn.0040cb6f
mov eax, dword [ebp - 0x85c]
mov esi, dword [ebp - 0x864]
cmp eax, edi
je 0x4487a4
cmp eax, dword [ebp - 0x878]
je 0x4487a9
call fcn.00455b8a
cmp dword [ebp - 0x858], esi
je 0x44881f
xor ebx, ebx
push 0x5c
inc ebx
lea esi, [ebp - 0x834]
call fcn.0040c1c7
lea esi, [ebp - 0x85c]
call fcn.0044a28c
push 0xffffffffffffffff
push edi
lea esi, [ebp - 0x834]
call fcn.0040cb6f
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x4487ef
lea eax, [ebp - 0x830]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x448808
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x448818
lea esi, [ebp - 0x85c]
call fcn.0043da00
jmp 0x44878c
mov edi, eax
jmp 0x448685
lea eax, [ebp - 0x834]
call fcn.0043b39a
lea eax, [ebp - 0x854]
call fcn.0043b39a
lea esi, [ebp - 0x878]
call fcn.0044a1e8
xor eax, eax
call fcn.00459cf9
ret
Function at 0x44956d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00463310
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x1018], ebx
call fcn.00449b09
mov dword [ebp - 0x1014], eax
call fcn.004498ef
test eax, eax
setne byte [ebp - 0x100d]
xor eax, eax
push 0xffe
mov word [ebp - 0x100c], ax
lea eax, [ebp - 0x100a]
push ebx
push eax
call fcn.0045f360
add esp, 0xc
lea esi, [ebp - 0x100c]
cmp edi, ebx
je 0x4495f5
cmp word [edi], bx
je 0x4495f5
push edi
mov eax, esi
push 0x800
push eax
call fcn.00455d11
add esp, 0xc
cmp word [ebp - 0x100c], bx
je 0x4495f5
inc esi
inc esi
cmp word [esi], bx
jne 0x4495ee
cmp dword [ebp + 8], ebx
jl 0x44962a
lea eax, [ebp - 0x100c]
cmp esi, eax
je 0x44960c
push 0x20
pop eax
mov word [esi], ax
inc esi
inc esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push str._opt_check
sub eax, esi
push str._s_d
sar eax, 1
push eax
push esi
call fcn.00455b9a
add esp, 0x14
call fcn.004496a8
test al, al
je 0x449671
cmp dword [ebp - 0x1014], 3
je 0x449656
cmp byte [ebp - 0x100d], bl
jne 0x449694
cmp dword [ebp - 0x1014], 1
jne 0x449679
call fcn.00449b4d
test eax, eax
je 0x449679
lea eax, [ebp - 0x100c]
push eax
call fcn.00448f28
pop ecx
cmp eax, 0x4c7
je 0x44969a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [ebp - 0x100d], bl
jne 0x449694
lea eax, [ebp - 0x100c]
push eax
call fcn.0044919e
pop ecx
mov dword [ebp - 0x1018], eax
cmp eax, ebx
jne 0x449694
push 0xfffffffffffffffe
jmp 0x44966b
mov eax, dword [ebp - 0x1018]
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.00453655
leave
ret

Function at 0x4496a8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [0x4a256c]
cmp eax, 0xffffffff
jne 0x4496fd
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.0045f360
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
sbb eax, eax
inc eax
mov dword [0x4a256c], eax
xor ecx, ecx
cmp eax, 1
sete cl
mov al, cl
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00453655
add ebp, 0x98
leave
ret