joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c630
Capabilities:
Delete file

Disassembly:
mov ecx, 0x5993f0
call fcn.00416300
mov eax, dword [0x5fd8fc]
test eax, eax
je 0x41c65b
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x5fd8fc], 0
mov eax, dword [0x5f649c]
push esi
cmp eax, 7
push edi
jne 0x41c6a0
push 0x3a
call fcn.0046dc70
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
add esp, 4
push eax
mov eax, dword [0x5fd8f8]
push 2
push eax
call esi
push 0xc358
call fcn.0046dc70
mov ecx, dword [0x5fd8f8]
add esp, 4
push eax
push 0x421
push ecx
call esi
jmp 0x41c6c0
push 0xc359
call fcn.0046dc70
mov edx, dword [0x5fd8f8]
add esp, 4
push eax
push 0x421
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x5f64c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x5fd8f8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 2
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov ecx, dword [0x5fd8f8]
push 1
push 4
push ecx
call esi
push eax
call edi
mov ecx, 0x5993f0
call fcn.00415fd0
pop edi
pop esi
ret
Function at 0x41c7a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x830
mov al, byte [0x595430]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x1c], al
mov ecx, 0x208
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x854]
test eax, eax
je 0x41c906
mov esi, dword [esp + 0x850]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ecx, dword [esp + 0x84c]
push eax
push ecx
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
lea edx, [esp + 0x2c]
push 0x823
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
push 0x511220
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
mov ebp, ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 0x20
test ebx, ebx
je 0x41c8ee
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
mov edi, eax
push 0
push ebx
mov dword [esp + 0x34], edi
call esi
mov ecx, dword [esp + 0x864]
add edi, ebp
add esp, 0x1c
mov dword [esp + 0x10], edi
mov edx, dword [ecx]
lea eax, [edi + 2]
cmp eax, edx
mov dword [esp + 0x14], eax
jae 0x41c8d3
mov eax, dword [esp + 0x844]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x1c]
mov edi, eax
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x854]
mov dx, word [0x51121c]
add esp, 0x10
mov word [eax + ecx], dx
mov eax, dword [esp + 0x848]
mov edx, dword [esp + 0x14]
push ebx
mov dword [eax], edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x830
ret
push ebx
mov dword [ecx], 0
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x830
ret
mov ecx, dword [esp + 0x848]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x830
ret
mov edx, dword [esp + 0x850]
mov eax, dword [esp + 0x84c]
push edx
push eax
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
lea ecx, [esp + 0x2c]
push 0x823
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x848]
not ecx
dec ecx
mov eax, ecx
mov ecx, dword [edx]
cmp eax, ecx
jae 0x41c978
mov edi, dword [esp + 0x844]
mov ecx, eax
mov ebx, ecx
lea esi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
add esp, 0x830
ret
pop edi
pop esi
pop ebp
mov dword [edx], 0
pop ebx
add esp, 0x830
ret
Function at 0x41cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041c990
add esp, 4
cmp eax, ebx
mov dword [0x5fd8fc], eax
je 0x41d1a4
mov dx, word [0x52a480]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x412]
mov word [ebp - 0x414], dx
mov word [ebp - 0x20c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x20c]
push 0x50f854
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, 0x5993f0
call fcn.00415fd0
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push str.http:__feedback.theworld.cn_collection_
mov ecx, 0x412
xor eax, eax
mov edi, 0x5f68d0
push 0x50f4e4
push 0x824
push 0x5f68d0
rep stosd dword es:[edi], eax
call esi
mov ecx, 0x82
xor eax, eax
mov edi, 0x5f64c0
add esp, 0x10
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x414]
push ecx
push 0x50f4e4
push 0x104
push 0x5f64c0
call esi
mov dx, word [0x52a480]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x61a]
mov word [ebp - 0x61c], dx
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, str.___________________________7d9114302a0cb6
mov dword [0x59ba94], 0x2710
test eax, eax
mov dword [0x59ba8c], 0x41d1c0
mov dword [0x59ba88], ebx
je 0x41d146
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004ba380
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push str.___________________________7d9114302a0cb6
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push str.multipart_form_data__boundary_s
lea ecx, [ebp - 0x61c]
push 0x103
push ecx
call esi
mov eax, dword [ebp - 4]
mov edx, dword [0x5fd8fc]
mov dword [0x59b870], eax
mov ecx, 0x82
xor eax, eax
mov edi, 0x59b874
mov dword [0x59b86c], edx
add esp, 0x10
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x61c]
push ecx
push 0x50f4e4
push 0x104
push 0x59b874
call esi
add esp, 0x10
mov ecx, 0x5993f0
call fcn.00415f00
lea esp, [ebp - 0x628]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d200
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
push ebp
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
test ebp, ebp
je 0x41d2f7
push ebx
push esi
push str.MiniDumpWriteDump
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x41d2ee
mov ax, word [0x52a480]
push edi
mov word [esp + 0x1c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x5fd6f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [esp + 0x24]
push 0x50f854
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push 0x5fd6f0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x41d2ee
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x224]
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebx
pop ebp
add esp, 0x214
ret
Function at 0x41d300
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x1458
call fcn.004ba380
push esi
push edi
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x41a]
mov word [esp + 0x418], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x52a4bc]
push eax
push str.3.0.9.5
call fcn.0046d9f0
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
push str.http:__stat.ioage.com_dimana.gif__pdttheworld3_dim_kpid__guid__ver_dim_vtheworld3___s___sm_d
lea eax, [esp + 0x428]
push 0x823
push eax
call esi
mov ecx, 0x412
xor eax, eax
mov edi, 0x5f68d0
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x418]
push ecx
push 0x50f4e4
push 0x824
push 0x5f68d0
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
mov word [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], 0
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x210]
stosw word es:[edi], ax
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esp + 0x218]
push 0x51143c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea edx, [esp + 8]
mov ecx, 0x82
push edx
xor eax, eax
mov edi, 0x5f64c0
push 0x50f4e4
push 0x104
push 0x5f64c0
rep stosd dword es:[edi], eax
call esi
add esp, 0x10
mov ecx, 0x5993f0
mov dword [0x59b854], 1
mov dword [0x59ba94], 0x1388
call fcn.00415f00
mov ecx, 0x5993f0
call fcn.00416300
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x5993f0
call fcn.00415fd0
pop edi
pop esi
add esp, 0x1458
ret
Function at 0x41eff0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0xa28
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ebx, dword [esp + 0xa3c]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], bp
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
stosw word es:[edi], ax
push 0x50f4e4
lea eax, [esp + 0x220]
push 0x103
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0x228]
push 0x5c
push ecx
call edi
add esp, 0x18
test eax, eax
je 0x41f066
add eax, 2
lea edx, [esp + 0x218]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea eax, [esp + 0x218]
push 0x2e
push eax
call edi
xor edx, edx
add esp, 8
cmp eax, edx
je 0x41f07e
mov word [eax], dx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62a]
mov word [esp + 0x628], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], dx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x628]
push ecx
push 0x103
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x218]
lea eax, [esp + 0x628]
push edx
push eax
push str._sTheWorld_skin_s_
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call esi
lea edx, [esp + 0x24]
push edx
call fcn.0042c110
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004b9330
mov cx, word [0x52a480]
xor eax, eax
mov word [esp + 0x440], cx
mov ecx, 0x81
lea edi, [esp + 0x442]
add esp, 0x20
rep stosd dword es:[edi], eax
push str.Skin
push 0x52a6e4
push 0x50fa9c
lea edx, [esp + 0x42c]
push 0x103
push edx
stosw word es:[edi], ax
call esi
lea eax, [esp + 0x434]
push eax
call fcn.0042c110
mov cx, word [0x52a480]
xor eax, eax
mov word [esp + 0x848], cx
mov ecx, 0x81
lea edi, [esp + 0x84a]
add esp, 0x18
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push edx
push str._sskin.ini
lea eax, [esp + 0x838]
push 0x103
push eax
call esi
lea ecx, [esp + 0x840]
push 0
push ecx
call fcn.0042b850
add esp, 0x18
test eax, eax
je 0x41f1b3
lea edx, [esp + 0x420]
push 1
lea eax, [esp + 0x14]
push edx
push eax
call fcn.0042c970
add esp, 0xc
mov ebp, 1
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x10]
push edx
call esi
push 0
push ebx
call fcn.0042c7c0
add esp, 8
push ebx
call esi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xa28
ret 4
Function at 0x41f280
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x668
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x672]
mov word [ebp - 0x674], bx
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov ecx, dword [0x6069dc]
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x674]
push 0x103
push eax
push ecx
call fcn.0042b860
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x46a]
mov word [ebp - 0x46c], bx
mov edx, dword [ebp + 8]
add esp, 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x51169c
lea eax, [ebp - 0x674]
push edx
push eax
push 0x50faf8
lea ecx, [ebp - 0x46c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x18
lea edx, [ebp - 0x264]
lea eax, [ebp - 0x46c]
mov word [ebp - 0x266], bx
push edx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x41f3a9
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea ecx, [ebp - 0x238]
push 0x511698
push ecx
call esi
add esp, 8
test eax, eax
je 0x41f390
lea edx, [ebp - 0x238]
push 0x511690
push edx
call esi
add esp, 8
test eax, eax
je 0x41f390
test byte [ebp - 0x264], 0x10
je 0x41f390
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x238]
push eax
push ebx
call fcn.0041dfd0
lea ecx, [ebp - 0x264]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f34d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x423540
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x42365f
mov eax, dword [esi + 0x10c]
mov dword [esi + 0x138], 1
test eax, eax
jne 0x42364f
mov eax, dword [esi + 0x118]
dec eax
je 0x423603
dec eax
jne 0x42365f
mov ecx, dword [esi + 0xd70]
lea eax, [esi + 0xb64]
push 0x51151c
push eax
call fcn.0041f450
mov edx, eax
test edx, edx
je 0x42365f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push edx
lea ecx, [esp + 0xc]
push 0x103
push ecx
push 0x52a480
push str.Type
push str.Global
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 8], 0
je 0x42365f
mov ecx, dword [esi + 0xd70]
lea edx, [esi + 0x108]
lea eax, [esp + 8]
push edx
push eax
call fcn.00423430
pop edi
pop esi
add esp, 0x208
ret
mov edi, dword [esi + 0xd6c]
test edi, edi
jne 0x42361a
mov ecx, esi
call fcn.00423460
mov edi, eax
test edi, edi
je 0x42365f
push str.Ext_GetExtensionType
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x5fd91c], eax
je 0x423637
call eax
mov dword [esi + 0x108], eax
cmp edi, dword [esi + 0xd6c]
je 0x42365f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
add esp, 0x208
ret
cmp eax, 1
jne 0x42365f
call fcn.004bba00
mov dword [esi + 0x108], eax
pop edi
pop esi
add esp, 0x208
ret
Function at 0x423bf0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x108]
sub esp, 0xa2c
cmp eax, 0x2000
push ebp
push esi
jne 0x423da3
lea eax, [ecx + 0xb64]
mov ecx, dword [ecx + 0xd70]
push 0x51151c
push eax
mov dword [esp + 0x10], eax
call fcn.0041f450
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x423da3
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x836]
mov word [esp + 0x834], bp
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
stosw word es:[edi], ax
lea eax, [esp + 0x838]
push 0x103
push eax
push 0x52a480
push str.Text
push str.SideWeb
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62e]
mov word [esp + 0x62c], bp
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x630]
push 0x103
push ecx
push 0x52a480
push 0x5117e4
push str.SideWeb
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bp
rep stosd dword es:[edi], eax
push esi
lea edx, [esp + 0x220]
push 0x103
push edx
push 0x52a480
push str.Icon
push str.SideWeb
stosw word es:[edi], ax
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x426]
mov word [esp + 0x424], bp
rep stosd dword es:[edi], eax
push 0x5c
push esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
cmp eax, ebp
pop edi
pop ebx
je 0x423d63
sub eax, esi
sar eax, 1
cmp eax, 0x103
jbe 0x423d33
mov eax, 0x103
push eax
lea eax, [esp + 0x420]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea ecx, [esp + 0x214]
lea edx, [esp + 0x41c]
lea eax, [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x423d79
lea ecx, [esp + 0x214]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp + 0x624]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x830]
push ecx
mov ecx, dword [esp + 0xa40]
push edx
push eax
push ecx
call fcn.004765a0
add esp, 0x14
pop esi
pop ebp
add esp, 0xa2c
ret 4
Function at 0x4249a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x620
push ebx
push ebp
lea eax, [esp + 8]
push edi
push eax
xor ebx, ebx
push str.Count
mov dword [esp + 0x18], ecx
push str.UnInstallExt
mov dword [esp + 0x18], ebx
call fcn.00408870
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], bx
rep stosd dword es:[edi], eax
mov cx, word [0x52a480]
mov word [esp + 0x430], bx
stosw word es:[edi], ax
mov word [esp + 0x20], cx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x432]
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, 0x52a488
stosw word es:[edi], ax
call fcn.00407c00
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push eax
lea edx, [esp + 0x428]
push 0x103
push edx
call ebp
lea eax, [esp + 0x430]
push ebx
push eax
call fcn.0042b850
add esp, 0x14
test eax, eax
je 0x424b10
cmp dword [esp + 0xc], ebx
jbe 0x424b03
push esi
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x18]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push str.ext_d
lea ecx, [esp + 0x20]
push 0x103
push ecx
call ebp
lea edx, [esp + 0x230]
push 0x104
lea eax, [esp + 0x2c]
push edx
push eax
push str.UnInstallExt
call fcn.004087b0
add esp, 0x20
lea ecx, [esp + 0x220]
push 0x511524
push ecx
call fcn.0041d460
mov ecx, eax
call fcn.0041f450
mov esi, eax
push 0
push esi
call fcn.0042b850
add esp, 8
test eax, eax
je 0x424af5
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x42c]
push esi
push edx
call fcn.004255e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
jb 0x424a5d
pop esi
push str.UnInstallExt
call fcn.00408340
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0x620
ret
Function at 0x424b20
Capabilities:
Delete directory

Disassembly:
sub esp, 0xa30
push ebx
push esi
mov esi, dword [esp + 0xa3c]
xor ebx, ebx
push 1
mov dword [esp + 0x10], ecx
push esi
mov dword [esp + 0x10], ebx
call fcn.0042b850
add esp, 8
test eax, eax
je 0x424d36
push ebx
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0046ad40
add esp, 0xc
cmp eax, 1
je 0x424d36
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x424d36
push ebp
push edi
push ebx
push str.Count
push str.UnInstallExt
push eax
call fcn.0046b3d0
mov ebp, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x84a]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
mov word [esp + 0x848], bx
add esp, 0x10
rep stosd dword es:[edi], eax
push ebp
push 0x50fae4
lea ecx, [esp + 0x840]
push 0x104
push ecx
stosw word es:[edi], ax
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x232]
mov word [esp + 0x230], bx
rep stosd dword es:[edi], eax
mov dx, word [0x52a480]
mov ecx, 0x81
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x43a]
mov word [esp + 0x438], dx
add esp, 0x10
rep stosd dword es:[edi], eax
test ebp, ebp
stosw word es:[edi], ax
jbe 0x424d25
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x428]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x224]
rep stosd dword es:[edi], eax
push str.ext_d
lea eax, [esp + 0x430]
push 0x103
push eax
call esi
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x230]
push 0x103
lea edx, [esp + 0x43c]
push ecx
push edx
push str.UnInstallExt
push eax
call fcn.0046b280
mov dx, word [0x52a480]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], dx
mov word [esp + 0x654], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [0x6069dc]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x656]
rep stosd dword es:[edi], eax
push 0
lea ecx, [esp + 0x658]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.0042b860
add esp, 0x34
lea eax, [esp + 0x220]
lea ecx, [esp + 0x220]
lea edx, [esp + 0x630]
push eax
push ecx
push str.Extensions
push edx
push str._s_s_s_s.dll
lea eax, [esp + 0x2c]
push 0x103
push eax
call esi
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.0042b850
add esp, 0x24
test eax, eax
je 0x424d1c
mov eax, dword [esp + 0xa44]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 1
push edx
push eax
call fcn.004255e0
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc ebx
cmp ebx, ebp
jb 0x424c03
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0046af40
add esp, 8
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xa30
ret 4