joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c490
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x49cf23
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x78], eax
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
xor eax, eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], eax
mov word [esp + 0x70], ax
mov dword [esp + 0x94], eax
mov esi, dword [ebx + 4]
cmp esi, dword [ebx + 8]
jbe 0x43c4f7
call fcn.00478a25
mov ebp, esi
lea esp, [esp]
mov esi, dword [ebx + 8]
cmp dword [ebx + 4], esi
jbe 0x43c50d
call fcn.00478a25
cmp ebp, esi
je 0x43c5f3
push 0x208
call fcn.0045a875
add esp, 4
cmp ebp, dword [ebx + 8]
mov edi, eax
jb 0x43c52e
call fcn.00478a25
cmp dword [ebp + 0x18], 8
jb 0x43c539
mov eax, dword [ebp + 4]
jmp 0x43c53c
lea eax, [ebp + 4]
push eax
push 0x104
push edi
call fcn.00478f31
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43c55d
push edi
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xor esi, esi
mov eax, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], si
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x43c575
sub eax, edx
sar eax, 1
push eax
push edi
lea esi, [esp + 0x1c]
call fcn.00401c20
mov eax, esi
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0x74]
mov byte [esp + 0x9c], 1
call fcn.004036a0
mov byte [esp + 0x94], 0
cmp dword [esp + 0x2c], 8
jb 0x43c5c4
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0045a870
add esp, 4
push 1
push 0x4a9c1c
lea ecx, [esp + 0x74]
call fcn.004035d0
push edi
call fcn.0045a870
add esp, 4
cmp ebp, dword [ebx + 8]
jb 0x43c5e7
call fcn.00478a25
mov edi, dword [esp + 0x10]
add ebp, 0x1c
jmp 0x43c500
push 0x38
lea edx, [esp + 0x38]
push 0
push edx
call fcn.0047dfc0
mov esi, 8
add esp, 0xc
cmp dword [edi + 0x18], esi
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], str.open
jb 0x43c637
mov eax, dword [edi + 4]
mov dword [esp + 0x40], eax
jmp 0x43c63e
add edi, 4
mov dword [esp + 0x40], edi
cmp dword [esp + 0x84], esi
jb 0x43c651
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x44], ecx
jmp 0x43c659
lea edx, [esp + 0x70]
mov dword [esp + 0x44], edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x50], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x43c68a
cmp dword [esp + 0x84], esi
jb 0x43c686
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0045a870
add esp, 4
xor al, al
jmp 0x43c6a2
cmp dword [esp + 0x84], esi
jb 0x43c6a0
mov edx, dword [esp + 0x70]
push edx
call fcn.0045a870
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00478599
add esp, 0x88
ret
Function at 0x43c940
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c861c]
sub esp, 0x50
test eax, eax
push ebx
push esi
push edi
je 0x43c958
push 1
push 0x80c8
call eax
push 0x4abde8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x43ca53
push 0x2c
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0047dfc0
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x30
mov dword [esp + 0x34], 0x43ca60
mov dword [esp + 0x40], esi
mov dword [esp + 0x54], str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x43c9bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x582
jne 0x43ca53
push 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 0
push 0
push 0x11
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10
call esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
push 0
push str.Canon.IC.AutoUpdate.StartDiffUpdater
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x43ca53
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
call esi
test eax, eax
jle 0x43ca43
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
call esi
test eax, eax
jg 0x43ca24
mov eax, dword [esp + 0x3c]
push eax
push str.Canon.IC.AutoUpdate.StartDiffUpdater
call dword [sym.imp.USER32.dll_UnregisterClassW]
pop edi
pop esi
pop ebx
add esp, 0x50
ret
Function at 0x43cd90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x43cdd6
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00478599
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43cde0
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00401c20
push 0x2f
push str.Canon_Inc_ICAutoUpdateCanonAutoUpdateLog.dat
mov ecx, esi
call fcn.004035d0
push 0x2f
push 0x5c
mov edi, esi
call fcn.00404060
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00478599
add esp, 0x20c
ret

Function at 0x43ce30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 0
call fcn.0047dfc0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 8]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43ce90
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xc]
push edx
call fcn.00401c20
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00478599
add esp, 0x210
ret
Function at 0x43ced0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x49ce9c
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x294]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2a4]
xor ebx, ebx
mov edi, 7
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], bx
lea eax, [esp + 0x84]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov dword [esp + 0x2b0], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
je 0x43cf65
cmp dword [esp + 0x80], 8
jb 0x43cf5e
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0045a870
add esp, 4
xor al, al
jmp 0x43d0d0
lea eax, [esp + 0x84]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x43cf70
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x88]
push edx
mov esi, ebp
call fcn.00401c20
mov ecx, dword [0x4c8544]
cmp ecx, ebx
jne 0x43cfb9
push 4
call fcn.0045a845
add esp, 4
cmp eax, ebx
je 0x43cfaf
mov dword [eax], vtable.CWinAUSystemUtil.0
jmp 0x43cfb1
xor eax, eax
mov ecx, eax
mov dword [0x4c8544], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
test al, al
jne 0x43d0a5
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
lea edi, [esp + 0x30]
mov byte [esp + 0x29c], 1
call fcn.00415ed0
mov ecx, edi
call fcn.00437360
cmp eax, 1
jne 0x43d084
lea esi, [esp + 0x4c]
call fcn.004338b0
mov byte [esp + 0x29c], 2
mov eax, dword [esp + 0x50]
mov esi, 8
cmp dword [esp + 0x64], esi
jae 0x43d01a
lea eax, [esp + 0x50]
cmp dword [esp + 0x48], esi
mov ecx, dword [esp + 0x34]
jae 0x43d028
lea ecx, [esp + 0x34]
call fcn.00440640
test eax, eax
je 0x43d06f
push ebp
lea eax, [esp + 0x50]
call fcn.00415480
cmp eax, 0xffffffff
je 0x43d06f
lea eax, [esp + 0x4c]
push eax
push ebp
lea ecx, [esp + 0x38]
lea edi, [esp + 0x1c]
call fcn.0043fc80
add esp, 8
push 0xffffffffffffffff
push ebx
mov ecx, ebp
mov byte [esp + 0x2a4], 3
call fcn.00401b70
mov ecx, edi
call fcn.00401620
cmp dword [esp + 0x64], esi
jb 0x43d089
mov ecx, dword [esp + 0x50]
push ecx
call fcn.0045a870
add esp, 4
jmp 0x43d089
mov esi, 8
mov byte [esp + 0x29c], bl
cmp dword [esp + 0x48], esi
jb 0x43d0aa
mov edx, dword [esp + 0x34]
push edx
call fcn.0045a870
add esp, 4
jmp 0x43d0aa
mov esi, 8
push 0x2f
push 0x5c
mov edi, ebp
call fcn.00404060
add esp, 8
cmp dword [esp + 0x80], esi
jb 0x43d0ce
mov eax, dword [esp + 0x6c]
push eax
call fcn.0045a870
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x294]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.00478599
add esp, 0x28c
ret
Function at 0x43d100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x43d146
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00478599
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43d150
sub eax, edx
push edi
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00401c20
push 0x2d
push str.Canon_Inc_ICAutoUpdateConnectedDevices.dat
mov ecx, esi
call fcn.004035d0
push 0x2f
push 0x5c
mov edi, esi
call fcn.00404060
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00478599
add esp, 0x20c
ret

Function at 0x43d420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49e128
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call fcn.0043ced0
mov ecx, dword [esp + 0x10]
add esp, 4
cmp dword [esp + 0x20], 8
jae 0x43d481
lea ecx, [esp + 0xc]
push esi
mov edx, str.Canon_Inc_IC_ServiceLog_AutoUpdateService
call fcn.00433100
add esp, 4
cmp dword [esp + 0x20], 8
jb 0x43d4a3
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045a870
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00478599
add esp, 0x30
ret
Function at 0x43dd30
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push ebp
mov ebp, dword [esp + 0xc]
push 0
push 1
push 0
push 0
push esi
mov dword [ebp], 0
call ebx
test eax, eax
jne 0x43dd5f
push 8
push 1
push eax
push eax
push esi
call ebx
test eax, eax
je 0x43ddb4
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x43dda9
mov eax, str.Canon_Inc_IC_Auto_Update
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43dd80
push 0
sub eax, edx
mov edx, dword [edi]
push eax
push str.Canon_Inc_IC_Auto_Update
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x43ddb9
mov eax, dword [edi]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
xor al, al
pop ebx
ret
mov edx, dword [edi]
mov eax, dword [esi]
push ebp
push 1
push edx
push 0x6601
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x43ddea
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [esi]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop ebp
xor al, al
pop ebx
ret
pop ebp
mov al, 1
pop ebx
ret

Function at 0x440c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49a7c9
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, 7
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], cx
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], cx
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], ecx
mov word [eax + 0x40], cx
mov dword [eax + 0x38], vtable.CAUVersionWithCondition.0
mov dword [eax + 0x70], edx
mov dword [eax + 0x6c], ecx
mov word [eax + 0x5c], cx
mov dword [eax + 0x74], vtable.CAUVersion.0
mov dword [eax + 0x90], edx
mov dword [eax + 0x8c], ecx
mov word [eax + 0x7c], cx
mov dword [eax + 0x94], vtable.CAURegions.0
mov dword [eax + 0xb0], edx
mov dword [eax + 0xac], ecx
mov word [eax + 0x9c], cx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov dword [eax + 0xc0], ecx
mov dword [eax + 0xdc], edx
mov dword [eax + 0xd8], ecx
mov word [eax + 0xc8], cx
mov dword [eax + 0x100], edx
mov dword [eax + 0xfc], ecx
mov word [eax + 0xec], cx
mov byte [eax + 0xe0], cl
mov dword [eax + 0xe4], ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4
Function at 0x4417c0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49dfa3
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x48], ebx
cmp dword [esi + 0x14], ebx
je 0x4418cd
cmp dword [esi + 0x18], 8
jb 0x441814
mov edi, dword [esi + 4]
jmp 0x441817
lea edi, [esi + 4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4418cd
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
cmp al, bl
jne 0x4418cd
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
lea eax, [esp + 0x20]
push eax
push esi
mov byte [esp + 0x50], 1
call fcn.0043da00
add esp, 8
test al, al
je 0x4418b9
push 0x14
call fcn.0045a845
add esp, 4
cmp eax, ebx
je 0x441883
mov dword [eax], vtable.CAUInstallLog.0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov edi, eax
jmp 0x441885
xor edi, edi
mov esi, edi
mov dword [esp + 0x1c], esi
push edi
lea eax, [esp + 0x24]
mov byte [esp + 0x4c], 3
call fcn.00456f20
test eax, eax
jne 0x4418a6
mov ebp, edi
xor esi, esi
mov dword [esp + 0x18], ebp
cmp esi, ebx
mov byte [esp + 0x48], 1
je 0x4418b9
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp dword [esp + 0x38], 8
jb 0x4418cd
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0045a870
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00478599
add esp, 0x38
ret
Function at 0x441b30
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49df53
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
cmp dword [esi + 0x14], ebp
je 0x441c41
cmp dword [esi + 0x18], 8
jb 0x441b81
mov edi, dword [esi + 4]
jmp 0x441b84
lea edi, [esi + 4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x441c41
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
test al, al
jne 0x441c41
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], 0
lea eax, [esp + 0x18]
push eax
push esi
mov byte [esp + 0x48], 1
call fcn.0043da00
add esp, 8
test al, al
je 0x441c2d
push 0x18
call fcn.0045a845
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x40], 2
je 0x441bf7
mov esi, eax
call fcn.004543b0
mov edi, eax
jmp 0x441bf9
xor edi, edi
mov esi, edi
mov dword [esp + 0x10], esi
push edi
lea eax, [esp + 0x1c]
mov byte [esp + 0x44], 3
call fcn.00454a90
test eax, eax
jne 0x441c1a
mov ebp, edi
xor esi, esi
mov dword [esp + 0x14], ebp
test esi, esi
mov byte [esp + 0x40], 1
je 0x441c2d
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp dword [esp + 0x30], 8
jb 0x441c41
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045a870
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00478599
add esp, 0x34
ret

Function at 0x441c70
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49cc6b
mov eax, dword fs:[0]
push eax
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x20]
mov eax, dword [ebp + 0x20]
call fcn.00454740
mov esi, eax
test esi, esi
je 0x441cd2
cmp dword [esi + 0xd4], 8
jb 0x441cb6
mov edi, dword [esi + 0xc0]
jmp 0x441cbc
lea edi, [esi + 0xc0]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x441cd0
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
jmp 0x441cd2
xor esi, esi
push 0x128
call fcn.0045a845
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x441d0d
push ebp
push eax
mov ecx, esi
call fcn.0043e8d0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 4
Function at 0x4421e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499473
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x84]
xor esi, esi
cmp ecx, esi
jne 0x44221f
mov dword [ebp - 0x14], esi
jmp 0x44222d
mov eax, dword [edi + 0x88]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x14], eax
xor ebx, ebx
nop
cmp ebx, dword [ebp - 0x14]
jae 0x442275
mov ecx, dword [edi + 0x84]
cmp ecx, esi
je 0x44224e
mov eax, dword [edi + 0x88]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x442253
call fcn.00478a25
mov eax, dword [edi + 0x84]
mov esi, dword [eax + ebx*4]
test esi, esi
je 0x44226e
call fcn.00456fb0
push esi
call fcn.0045a870
add esp, 4
add ebx, 1
xor esi, esi
jmp 0x442230
mov ecx, dword [edi + 0x94]
cmp ecx, esi
jne 0x442284
mov dword [ebp - 0x14], esi
jmp 0x442292
mov eax, dword [edi + 0x98]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 6
xor ebx, ebx
cmp ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
jae 0x4422f9
mov byte [ebp - 4], 0xd
mov ecx, dword [edi + 0x94]
cmp ecx, esi
je 0x4422c0
mov eax, dword [edi + 0x98]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x4422c5
call fcn.00478a25
mov ecx, dword [edi + 0x94]
mov ecx, dword [ecx + ebx*4]
cmp ecx, esi
je 0x4422da
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [ebp - 4], 6
add ebx, 1
jmp 0x44229b
cmp dword [edi + 0xb8], 8
jb 0x442311
mov ecx, dword [edi + 0xa4]
push ecx
call fcn.0045a870
add esp, 4
mov dword [edi + 0xb8], 7
mov dword [edi + 0xb4], esi
mov word [edi + 0xa4], si
mov eax, dword [edi + 0x94]
cmp eax, esi
je 0x44233b
push eax
call fcn.0045a870
add esp, 4
mov dword [edi + 0x94], esi
mov dword [edi + 0x98], esi
mov dword [edi + 0x9c], esi
mov eax, dword [edi + 0x84]
cmp eax, esi
je 0x442360
push eax
call fcn.0045a870
add esp, 4
mov dword [edi + 0x84], esi
mov dword [edi + 0x88], esi
mov dword [edi + 0x8c], esi
mov ebx, vtable.CAUVersion.0
mov dword [edi + 0x60], ebx
cmp dword [edi + 0x7c], 8
jb 0x44238c
mov edx, dword [edi + 0x68]
push edx
call fcn.0045a870
add esp, 4
mov dword [edi + 0x7c], 7
mov dword [edi + 0x78], esi
mov word [edi + 0x68], si
mov dword [edi + 0x40], ebx
cmp dword [edi + 0x5c], 8
jb 0x4423af
mov eax, dword [edi + 0x48]
push eax
call fcn.0045a870
add esp, 4
mov dword [edi + 0x5c], 7
mov dword [edi + 0x58], esi
mov word [edi + 0x48], si
mov dword [edi + 0x20], ebx
cmp dword [edi + 0x3c], 8
jb 0x4423d2
mov ecx, dword [edi + 0x28]
push ecx
call fcn.0045a870
add esp, 4
mov dword [edi + 0x3c], 7
mov dword [edi + 0x38], esi
mov word [edi + 0x28], si
mov dword [edi], ebx
cmp dword [edi + 0x1c], 8
jb 0x4423f4
mov edx, dword [edi + 8]
push edx
call fcn.0045a870
add esp, 4
mov dword [edi + 0x1c], 7
mov dword [edi + 0x18], esi
mov word [edi + 8], si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4452b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x49cba0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
xor ebx, ebx
push 0xffffffffffffffff
mov esi, ecx
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.00401b70
mov dword [esp + 0x58], ebx
push 0xffffffffffffffff
push ebx
mov eax, esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
call fcn.00401b70
push 0x5c
push 0x2f
lea edi, [esp + 0x1c]
mov byte [esp + 0x60], 1
call fcn.00404060
push 0x5c
push 0x2f
lea edi, [esp + 0x40]
call fcn.00404060
mov esi, dword [esp + 0x28]
mov edi, 8
add esp, 0x10
cmp dword [esp + 0x2c], edi
jae 0x44535e
lea esi, [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x445379
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
cmp al, bl
jne 0x445390
cmp dword [esp + 0x2c], edi
mov eax, dword [esp + 0x18]
jae 0x445387
lea eax, [esp + 0x18]
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [esp + 0x14]
push eax
lea esi, [esp + 0x34]
call fcn.0044c5f0
add esp, 4
cmp dword [esp + 0x48], edi
mov byte [esp + 0x13], al
jb 0x4453b8
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0045a870
add esp, 4
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
jb 0x4453dc
mov edx, dword [esp + 0x18]
push edx
call fcn.0045a870
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00478599
add esp, 0x4c
ret