joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movd xmm0, dword [ebp + 0x10]
mov edi, 0x40
movdqu xmm3, xmmword [esi]
movdqu xmm4, xmmword [esi + 0x10]
movdqu xmm2, xmmword [esi + 0x20]
movdqu xmm1, xmmword [esi + 0x30]
lea eax, [edx - 0x40]
lea ecx, [esi + edi]
cmp eax, edi
pxor xmm0, xmm3
jb 0x4044e3
add edx, 0xffffff80
movdqa xmm5, xmmword [0x512640]
mov edi, edx
and edi, 0xffffffc0
lea ebx, [edi + 0x80]
movdqa xmm3, xmmword [0x512630]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [ecx]
add eax, 0xffffffc0
pclmulqdq xmm7, xmm5, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm0, xmm6
movdqa xmm6, xmm4
pclmulqdq xmm6, xmm3, 0
movdqa xmm3, xmm4
movdqu xmm4, xmmword [ecx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm5, 0x11
pxor xmm4, xmm6
movdqa xmm6, xmm2
movdqu xmm2, xmmword [ecx + 0x20]
pclmulqdq xmm6, xmmword [0x512630], 0
pxor xmm4, xmm3
movdqa xmm3, xmm1
pclmulqdq xmm3, xmmword [0x512630], 0
pxor xmm2, xmm6
movdqa xmm6, xmm1
movdqu xmm1, xmmword [ecx + 0x30]
add ecx, 0x40
cmp eax, 0x3f
pclmulqdq xmm6, xmm5, 0x11
pxor xmm2, xmm7
pxor xmm1, xmm3
pxor xmm1, xmm6
ja 0x404439
sub edx, edi
add esi, ebx
mov eax, edx
mov ecx, esi
movdqa xmm5, xmmword [0x512660]
movdqa xmm3, xmmword [0x512650]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm6, xmm3, 0
pxor xmm0, xmm4
pxor xmm0, xmm6
movdqa xmm4, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm4, xmm3, 0
pxor xmm0, xmm2
pxor xmm0, xmm4
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm3, 0
pxor xmm0, xmm1
pxor xmm0, xmm2
jb 0x404567
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
add eax, 0xfffffff0
add ecx, 0x10
pclmulqdq xmm2, xmm3, 0
cmp eax, 0xf
pxor xmm0, xmm1
pxor xmm0, xmm2
ja 0x404540
movdqa xmm1, xmmword [0x512660]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x512670], 0
pxor xmm1, xmm0
pmovzxdq xmm0, xmm1
pclmulqdq xmm0, xmmword [0x512680], 0x10
pmovzxdq xmm0, xmm0
pclmulqdq xmm0, xmmword [0x512690], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
dec eax
mov dword [edi], esp
mov dword [edi + 0xc], eax
mov dword [edi + 8], 0x4094f0
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00406936
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_char_.0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
xor eax, eax
add ebx, esi
dec eax
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], 0
push ebx
call fcn.00417e84
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.004099c2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4088c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
mov dword [edi], esp
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 8], 0x409500
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00406b38
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_wchar_t_.0
add ebx, esi
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x30], 0xffff
mov byte [esi + 0x32], 0
push ebx
call fcn.00417e84
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.004099c2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x409150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x565fa8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004fd70a
add esp, 0x10
cmp eax, esi
jne 0x4091c0
cmp ebx, 1
je 0x409169
cmp ebx, 2
mov esi, 0xffffffff
je 0x4091c3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004fd2ae
add esp, 4
neg eax
sbb esi, esi
jmp 0x4091c3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4091e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x409204
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004fd70a
add esp, 0x14
jmp 0x409233
test esi, esi
jle 0x40922c
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x40922e
inc edi
mov eax, ebx
cmp esi, edi
jne 0x40920d
mov edi, esi
jmp 0x40922e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x409240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x565fa8]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x409300
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x409287
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.004fd70a
add esp, 0x10
cmp eax, edi
je 0x409300
jmp 0x40930a
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x40930a
mov edi, eax
cmp eax, 3
je 0x4092e8
cmp edi, 1
ja 0x40930a
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.004fd70a
add esp, 0x10
cmp eax, ebx
jne 0x40930a
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x409292
jmp 0x4092fd
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.004fd70a
add esp, 0x10
cmp eax, edi
jne 0x40930a
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
jmp 0x40930d
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x409360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x409384
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004fd70a
add esp, 0x14
jmp 0x4093b4
test esi, esi
jle 0x4093ad
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x4093af
inc edi
mov eax, ebx
cmp esi, edi
jne 0x40938d
mov edi, esi
jmp 0x4093af
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4093c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x565fa8]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x409485
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x40940b
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.004fd70a
add esp, 0x10
cmp eax, esi
je 0x409485
jmp 0x409490
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x409490
mov ebx, eax
cmp eax, 3
je 0x40946c
cmp ebx, 1
ja 0x409490
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004fd70a
add esp, 0x10
cmp eax, esi
jne 0x409490
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x409416
jmp 0x409481
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004fd70a
add esp, 0x10
cmp eax, ebx
jne 0x409490
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
jmp 0x409493
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x409610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x40963f
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x409621
pop esi
pop edi
pop ebp
ret 8

Function at 0x409740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x409771
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x409751
pop esi
pop edi
pop ebp
ret 8
Function at 0x40e7d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41c440
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x513742
push eax
call fcn.0040e48c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040b4b0
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041ebb9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040e4f6
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.004e6ca0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00406dd0
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.0040e550
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x40e8eb
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00401a70
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4100c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x41c4f0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x513742
push eax
call fcn.0040e48c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.0040b4b0
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.0041ebb9
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.0040e4f6
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.004e6ca0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00406dd0
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.0040fc70
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x4101dd
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.0040ff00
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x412e78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041bcd2
mov ebx, eax
test esi, esi
je 0x412eb1
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x412e9e
movzx eax, word [eax]
jmp 0x412ea5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
je 0x412eb1
test bl, bl
jne 0x412eb7
jmp 0x412f14
xor esi, esi
test bl, bl
jne 0x412f05
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x412ec6
movzx eax, word [eax]
jmp 0x412ecb
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp + 0x14]
movzx eax, ax
mov edx, dword [ecx]
push eax
push 8
call dword [edx + 0xc]
test al, al
je 0x412ef6
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ecx + 0x10]
je 0x412eef
add eax, 2
mov dword [ecx + 0xc], eax
jmp 0x412e84
mov eax, dword [ecx]
call dword [eax + 0x24]
jmp 0x412e84
mov ecx, edi
call fcn.0041bcd2
mov ebx, eax
test esi, esi
jne 0x412f1d
jmp 0x412f0e
mov ecx, edi
call fcn.0041bcd2
mov ebx, eax
test bl, bl
jne 0x412f3c
jmp 0x412f42
mov ecx, edi
call fcn.0041bcd2
mov ebx, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x412f2a
movzx eax, word [eax]
jmp 0x412f31
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
cmp ax, 0xffff
sete al
xor bl, al
jne 0x412f42
mov eax, dword [ebp + 0x10]
or byte [eax], 2
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x424500
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx edx, byte [ebp + 0xc]
pop ebp
jmp fcn.00424510

Function at 0x4248c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x565fa8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x193
push str..._.._base_files_file_util_win.cc
push 0x5158db
push ebx
call fcn.00426b50
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
push ebx
call fcn.004307d0
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x424909
mov eax, dword [edi]
cmp byte [esi + 0xb], 0
mov ecx, esi
jns 0x424913
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
test eax, eax
jne 0x42497a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425ab0
add esp, 4
cmp byte [esi + 0xb], 0
mov dword [ebp - 0x30], eax
jns 0x42493b
mov esi, dword [esi]
cmp byte [edi + 0xb], 0
jns 0x424943
mov edi, dword [edi]
push 0
push 0
push 2
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x42497a
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x424978
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425ab0
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp eax, 0xfffffffc
cmovne ecx, eax
mov dword [esi], ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.004308d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4249a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x565fa8]
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1ba
push str..._.._base_files_file_util_win.cc
push str.PathExists
push ebx
call fcn.00426b50
add esp, 0x10
lea esi, [ebp - 0x1c]
mov ecx, esi
push 0
push ebx
call fcn.004307d0
cmp byte [edi + 0xb], 0
jns 0x4249e6
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov ecx, esi
setne bl
call fcn.004308d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x424a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x565fa8]
lea esi, [ebp - 0x21a]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
xor ebx, ebx
cmp eax, 0x102
ja 0x424a94
cmp word [ebp - 0x21a], 0
je 0x424a5e
xor ebx, ebx
nop
cmp word [ebp + ebx*2 - 0x218], 0
lea ebx, [ebx + 1]
jne 0x424a50
lea edi, [ebp - 0x234]
mov ecx, edi
push ebx
push esi
call fcn.00422d90
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00423f80
mov ecx, dword [ebp + 8]
push ebx
call fcn.00422e40
mov ecx, ebx
call fcn.00422e00
mov ecx, edi
call fcn.00422e00
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x424ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov eax, dword [0x565fa8]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x214]
xor eax, ebp
mov dword [ebp - 0xc], eax
push edi
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x424b09
cmp word [ebp - 0x214], 0
je 0x424b09
xor eax, eax
nop dword [eax]
cmp word [ebp + eax*2 - 0x212], 0
lea eax, [eax + 1]
jne 0x424af0
mov ecx, esi
push eax
push edi
call fcn.00422d90
jmp 0x424b44
lea edi, [ebp - 0x220]
mov ecx, edi
call fcn.00422d30
push edi
call fcn.00424a10
add esp, 4
mov ecx, esi
test al, al
je 0x424b2d
push edi
call fcn.00422d60
jmp 0x424b39
push 3
push 0x515904
call fcn.00422d90
lea ecx, [ebp - 0x220]
call fcn.00422e00
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e6891
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
Function at 0x424e40
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [0x565fa8]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x267
push str..._.._base_files_file_util_win.cc
push str.CreateDirectoryAndGetError
push edi
call fcn.00426b50
add esp, 0x10
lea ecx, [ebp - 0x38]
push 0
push edi
call fcn.004307d0
cmp byte [esi + 0xb], 0
mov ebx, esi
jns 0x424e86
mov ebx, dword [esi]
mov edi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424eb8
mov bl, 1
test al, 0x10
jne 0x424fcb
test edi, edi
je 0x424ea9
mov dword [edi], 0xfffffff7
push 0x50
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x424fcb
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.00423660
movzx ecx, byte [ebp - 0x39]
test cl, cl
mov eax, ecx
jns 0x424ed0
mov eax, dword [ebp - 0x40]
movzx edx, byte [esi + 0xb]
mov dword [ebp - 0x48], ebx
test dl, dl
mov edi, edx
jns 0x424ee0
mov edi, dword [esi + 4]
cmp eax, edi
jne 0x424f23
test eax, eax
je 0x424f0f
test cl, cl
lea ecx, [ebp - 0x44]
jns 0x424ef2
mov ecx, dword [ebp - 0x44]
test dl, dl
mov edx, esi
jns 0x424efa
mov edx, dword [esi]
xor edi, edi
nop dword [eax]
movzx ebx, word [ecx + edi*2]
cmp bx, word [edx + edi*2]
jne 0x424f23
inc edi
cmp eax, edi
jne 0x424f00
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x424f1c
mov dword [eax], 0xfffffffc
push 2
jmp 0x424fbb
mov edi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x44]
push eax
call fcn.00424e40
add esp, 8
test al, al
je 0x424fc1
push 0
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x424fc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov dword [ebp - 0x48], eax
jne 0x424fa8
push 0x1cc
push str..._.._base_files_file_util_win.cc
push str.DirectoryExists
lea eax, [ebp - 0x2c]
push eax
call fcn.00426b50
add esp, 0x10
lea ecx, [ebp - 0x1c]
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004307d0
cmp byte [esi + 0xb], 0
jns 0x424f8d
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.004308d0
cmp esi, 0xffffffff
je 0x424fa8
and esi, 0x10
jne 0x424fc3
mov esi, dword [ebp - 0x48]
test edi, edi
je 0x424fba
push esi
call fcn.00425ab0
add esp, 4
mov dword [edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [ebp - 0x44]
call fcn.00422e00
lea ecx, [ebp - 0x38]
call fcn.004308d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e6891
mov eax, ebx
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret