joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445100
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
mov eax, esi
mov edi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x412e2e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x412f08
push edi
lea ecx, [ebp - 0x2c]
call fcn.00405e70
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp dword [ebp - 0x1c], eax
je 0x412e8a
lea eax, [ebp - 0x2c]
push eax
call fcn.004222c0
add esp, 4
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
mov word [eax], cx
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407d10
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x412ece
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412ec4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412f41
push edx
push ecx
call fcn.004241cb
add esp, 8
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x412f19
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x412efa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412f46
push edx
push ecx
call fcn.004241cb
add esp, 8
mov al, 1
jmp 0x412f25
push esi
push edi
mov dword [ebp - 4], 1
call fcn.00418d30
add esp, 8
mov al, 1
jmp 0x412f25
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
call fcn.0042b37c
call fcn.0042b37c
int3

Function at 0x413010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4130b1
cmp byte [esi + 0x3d], 0
je 0x4130b1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x413067
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x413079
sub eax, 1
je 0x41307d
sub eax, 2
je 0x4130b1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41309a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042d323
add esp, 0x10
cmp edi, eax
jne 0x413067
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00424185
mov esp, ebp
pop ebp
ret
Function at 0x4155c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4155f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41562c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41562c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x415711
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x415654
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x415687
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0042ca2d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x415711
cmp eax, 1
jle 0x4156e4
cmp eax, 3
jne 0x415711
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.0040fef0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x415701
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042d323
add esp, 0x10
cmp edi, eax
jne 0x415711
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x415617
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
Function at 0x415fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x415ff4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406e20
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x416015
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x416017
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x41609f
jg 0x41602a
test esi, esi
je 0x41609f
test ecx, ecx
jl 0x41606c
jg 0x416034
test eax, eax
je 0x41606c
cmp ebx, ecx
jg 0x416046
jl 0x41603e
cmp esi, eax
jae 0x416046
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00425e50
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x416072
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x41609f
jg 0x41607c
test esi, esi
je 0x41609f
cmp dword [edi + 0x4c], 0
je 0x41609f
mov ecx, edi
call fcn.00413f60
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0042cd1d
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4160c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4160e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406d40
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x416105
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x416107
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x416184
jg 0x41611a
test esi, esi
je 0x416184
test ecx, ecx
jl 0x41615e
jg 0x416124
test eax, eax
je 0x41615e
cmp edi, ecx
jg 0x416136
jl 0x41612e
cmp esi, eax
jae 0x416136
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00425e50
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x416161
mov edx, dword [ebp + 8]
test edi, edi
jl 0x416184
jg 0x41616b
test esi, esi
je 0x416184
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x416184
push eax
push esi
push 1
push edx
call fcn.0042d323
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418330
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44597b
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
call fcn.00417b30
push dword [edi + 8]
mov dword [edi + 0xc8], 0
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4183ad
mov eax, dword [edi + 8]
test eax, eax
je 0x41838b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 3
lea ecx, [ebp - 0xf0]
mov esi, eax
call fcn.00406430
lea ecx, [edi + 0xb0]
mov dword [ebp - 4], 0
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.0041aaa0
add esp, 8
push str.__Cannot_delete_service.
push eax
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 1
push 0x447bb0
push eax
call fcn.00409a30
add esp, 8
push eax
call fcn.00409c90
add esp, 8
push eax
call fcn.00409a30
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406180
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00406410
push esi
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x20]
push eax
call fcn.00425c43
int3

Function at 0x418450
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44597b
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.00417b30
test al, al
jne 0x418495
mov eax, 1
jmp 0x4184b3
push esi
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4184b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 0xc], 0
je 0x4184d0
jmp 0x4184b3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 8
push 1
push 3
lea ecx, [ebp - 0xf0]
mov esi, eax
call fcn.00406430
lea ecx, [edi + 0xb0]
mov dword [ebp - 4], 0
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.0041aaa0
add esp, 8
push str.__Cannot_get_service_status.
push eax
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 1
push 0x447bb0
push eax
call fcn.00409a30
add esp, 8
push eax
call fcn.00409c90
add esp, 8
push eax
call fcn.00409a30
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00406180
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xf0]
call fcn.00406410
push esi
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x20]
push eax
call fcn.00425c43
int3
Function at 0x418570
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4459cb
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 8]
call fcn.00417b30
test al, al
jne 0x4185b2
mov eax, 1
jmp 0x418618
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.004186d0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push esi
lea eax, [ebp - 0x2c]
movq qword [ebp - 0x1c], xmm0
push eax
mov ecx, edi
movups xmmword [ebp - 0x2c], xmm0
call fcn.00418450
cmp dword [ebp - 0x28], 1
je 0x418616
lea eax, [ebp - 0x2c]
push eax
push 1
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41860c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x426
je 0x41860c
cmp byte [ebp + 8], 0
je 0x418635
jmp 0x418618
push dword [ebp + 8]
mov ecx, edi
call fcn.00418ac0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 4
call esi
push 1
push 3
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.00406430
lea ecx, [edi + 0xb0]
mov dword [ebp - 4], 0
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.0041aaa0
add esp, 8
push str.__Cannot_stop_service.
push eax
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 1
push 0x447bb0
push eax
call fcn.00409a30
add esp, 8
push eax
call fcn.00409c90
add esp, 8
push eax
call fcn.00409a30
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00406180
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x10c]
call fcn.00406410
push esi
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x3c]
push eax
call fcn.00425c43
int3
Function at 0x418d30
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445a83
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x418d6a
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 8
jb 0x418d72
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x418d98
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 3
lea ecx, [ebp - 0xe8]
mov esi, eax
call fcn.00406430
lea eax, [ebp - 0xd8]
mov dword [ebp - 4], 0
push str.Could_not_rename_file__error_:
push eax
call fcn.00409a30
add esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xe8]
push eax
call fcn.00406410
push esi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x38]
push eax
call fcn.00425c43
int3
Function at 0x419530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445b98
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov esi, dword [ecx + 4]
mov eax, dword [ecx]
cmp esi, eax
je 0x4196cb
mov ecx, dword [ecx + 4]
mov edx, esi
sub edx, eax
sub ecx, eax
sar edx, 1
sar ecx, 1
cmp edx, ecx
jb 0x419687
cmp word [eax + ecx*2 - 2], 0
jne 0x4196f1
xor ecx, ecx
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], cx
mov ecx, eax
mov dword [ebp - 0x2c], 7
lea edi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4195b0
sub ecx, edi
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00407d10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00419ea0
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x14]
cmp eax, 0xffffffff
setne bl
cmp edx, 8
jb 0x419632
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419628
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4196ec
push edx
push ecx
call fcn.004241cb
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x419683
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419679
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4196ec
push edx
push ecx
call fcn.004241cb
add esp, 8
test bl, bl
jmp 0x4196a1
movzx edi, word [eax + edx*2]
lea ebx, [eax + edx*2]
xor ecx, ecx
push eax
mov word [ebx], cx
call fcn.0041a550
add esp, 4
mov word [ebx], di
test al, al
jne 0x4196cb
mov eax, dword [ebp - 0x44]
lea ecx, [esi - 2]
mov esi, ecx
mov eax, dword [eax]
cmp ecx, eax
je 0x4196bf
cmp word [esi - 2], 0x5c
je 0x4196bf
add esi, 0xfffffffe
cmp esi, eax
jne 0x4196b1
cmp esi, eax
je 0x4196cb
mov ecx, dword [ebp - 0x44]
jmp 0x419574
mov eax, dword [ebp - 0x48]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
call fcn.0042b37c
push str.GetExistingPathPos:_Invalid_source__should_be_zero_ended
lea ecx, [ebp - 0x1c]
call fcn.00401490
push 0x45b95c
lea eax, [ebp - 0x1c]
push eax
call fcn.00425c43
int3
Function at 0x41a060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445d5d
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0
call fcn.00426a00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41a149
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a0f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407d10
push 0xa
push str._syswow64_
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
call fcn.00407e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
push str.GetWindowsDirectoryW_failed
lea ecx, [ebp - 0x230]
call fcn.00406310
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x248]
push eax
call fcn.00425c43
int3

Function at 0x41a190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445d5d
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0
call fcn.00426a00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41a279
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a220
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407d10
push 0xa
push str._system32_
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
call fcn.00407e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
push str.GetWindowsDirectoryW_failed
lea ecx, [ebp - 0x230]
call fcn.00406310
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x248]
push eax
call fcn.00425c43
int3
Function at 0x41a2c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x234], esi
call fcn.00426a00
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41a37a
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a340
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407d10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
push str.GetWindowsDirectoryW_failed
lea ecx, [ebp - 0x230]
call fcn.00406310
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x244]
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x244]
push eax
call fcn.00425c43
int3

Function at 0x41a550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a596
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00407d10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00419ea0
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x14]
cmp eax, 0xffffffff
setne bl
cmp edx, 8
jb 0x41a614
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a60a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a67b
push edx
push ecx
call fcn.004241cb
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x41a65e
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a654
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a680
push edx
push ecx
call fcn.004241cb
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret
call fcn.0042b37c
call fcn.0042b37c
int3