joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f787
Capabilities:
Copy file

Disassembly:
mov eax, 0x4e452f
call fcn.004d1d50
sub esp, 0x88
mov eax, dword [0x52e400]
push esi
xor eax, ebp
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x10], eax
call fcn.0048eee1
and dword [ebp - 4], 0
lea eax, [ebp - 0x88]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call fcn.004919ac
cmp dword [ebp - 0x14], 1
pop ecx
pop ecx
jne 0x48f888
add esi, 0x1c
push esi
lea ecx, [ebp - 0x8c]
call fcn.004105a6
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x90]
call fcn.004014a4
push dword [eax]
lea ecx, [ebp - 0x8c]
call fcn.0048f088
push dword [ebp - 0x90]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x90]
call fcn.004014a4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x94]
call fcn.004014a4
push dword [eax]
lea ecx, [ebp - 0x90]
call fcn.0048f088
push dword [ebp - 0x94]
call esi
push 0
push dword [ebp - 0x90]
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [ebp - 0x90]
mov edi, eax
call esi
push dword [ebp - 0x8c]
call esi
mov esi, edi
jmp 0x48f8f5
cmp dword [ebp - 0x14], 0
jne 0x48f8f3
add esi, 0x1c
push esi
lea ecx, [ebp - 0x8c]
call fcn.004105a6
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x94]
call fcn.004014a4
push dword [eax]
lea ecx, [ebp - 0x8c]
call fcn.0048f088
push dword [ebp - 0x94]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push dword [ebp - 0x8c]
call fcn.0048f6ba
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
sete cl
mov edi, ecx
jmp 0x48f87c
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.0048efa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d1da7
leave
ret 4
Function at 0x490e6b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e46ca
call fcn.004d1d50
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0xc], edi
mov dword [ebp - 0x10], esi
mov dword [eax], vtable.xl::win32::net::asyn_http_file_event.0
mov dword [ebp - 4], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0045178d
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x5e0], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4913a0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4e4758
call fcn.004d1d50
sub esp, 0x2a0
mov eax, dword [0x52e400]
push ebx
push esi
xor eax, ebp
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
mov eax, dword [esi + 0x28]
push str.silence.ini
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xf
pop ecx
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x50], bx
lea edi, [ebp - 0x4e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x258]
push eax
push 0x20
lea eax, [ebp - 0x50]
push eax
push str.00_00_00
push str.LastDate
push str.date
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x274]
push eax
call fcn.00486a9f
push str._Y__m__d
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x274]
call fcn.00491328
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x25c]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jle 0x4914e2
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 1
call fcn.00458dd1
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x2ac]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.http:__media.info.client.xunlei.com_silence.ini
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x290]
push eax
push ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00451d53
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], bl
call fcn.0040cd6b
mov ecx, dword [ebp - 0x25c]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret
Function at 0x495689
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4956b7
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0xc]
mov ecx, dword [esi]
push dword [ebp + 8]
call fcn.00407a49
pop esi
leave
ret 8
Function at 0x497ba8
Capabilities:
Check if file exists

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
je 0x497bcb
push dword [esp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x497bcb
mov ecx, esi
call fcn.00497999
test eax, eax
jne 0x497bd1
xor al, al
pop esi
ret 8
pop esi
mov ecx, eax
jmp 0x4a879e
mov eax, 0x4e60fb
call fcn.004d1d50
sub esp, 0x38
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x10], ecx
je 0x4a87c3
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a87ca
xor al, al
jmp 0x4a88fe
push ebx
lea ecx, [ebp - 0x44]
call fcn.0040f3ff
mov dword [ebp - 0x44], vtable.xlue_basic_xml_dom_parser_char_.0
push esi
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], esi
call fcn.0040f969
push dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
call fcn.004a4c16
test al, al
lea ecx, [ebp - 0x40]
jne 0x4a8805
call fcn.0040e35c
xor bl, bl
jmp 0x4a88e8
push edi
call fcn.0040e35c
lea ecx, [ebp - 0x44]
call fcn.00446f58
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, esi
mov byte [ebp - 4], 1
jne 0x4a8827
xor bl, bl
jmp 0x4a88e7
lea ecx, [edi + 0x30]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
cmp eax, esi
je 0x4a88da
push str.skin
push eax
call sub.MSVCR71.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x4a88da
lea ecx, [edi + 0x80]
call fcn.0048f0fe
cmp eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], esi
jbe 0x4a88d6
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00449647
mov esi, eax
mov dword [ebp - 0x1c], esi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ebx, eax
push str.color_scheme
push ebx
call sub.MSVCR71.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x4a889f
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.004a6680
jmp 0x4a88bc
push str.auto_color_scheme
push ebx
call sub.MSVCR71.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x4a88bc
mov ecx, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
call fcn.004a6698
test esi, esi
mov byte [ebp - 4], 1
je 0x4a88cb
mov ecx, esi
call fcn.0040de1d
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x14]
jb 0x4a8862
mov bl, 1
jmp 0x4a88dc
xor bl, bl
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0040de1d
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], vtable.xlue_basic_xml_dom_parser_char_.0
call fcn.0040ee8c
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x497c09
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4e4e
call fcn.004d1d50
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
lea edx, [eax + 0x78]
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
leave
ret
Function at 0x497cf5
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4e4f67
call fcn.004d1d50
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.SkinManager.3.0
mov dword [esi + 4], vtable.SkinManager.2.0
mov dword [esi + 8], vtable.SkinManager.1.0
mov dword [esi + 0xc], vtable.SkinManager.0
lea ecx, [esi + 0x3b4]
mov dword [ebp - 4], 0x12
call sub.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_
lea ecx, [esi + 0x3a4]
mov byte [ebp - 4], 0x11
call fcn.00431326
lea ecx, [esi + 0x398]
mov byte [ebp - 4], 0x10
call fcn.0049796e
lea ecx, [esi + 0x388]
mov byte [ebp - 4], 0xf
call fcn.004abeb4
lea ecx, [esi + 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.0049f151
lea ecx, [esi + 0x218]
mov byte [ebp - 4], 0xd
call fcn.00497c7c
lea ecx, [esi + 0x1e4]
mov byte [ebp - 4], 0xc
call fcn.004a14e0
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 0xb
call fcn.004a050a
lea ecx, [esi + 0x154]
mov byte [ebp - 4], 0xa
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0x138]
mov byte [ebp - 4], 9
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0x11c]
mov byte [ebp - 4], 8
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0x100]
mov byte [ebp - 4], 7
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esi + 0xd4]
mov byte [ebp - 4], 6
call fcn.0049cca9
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00497943
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 3
call fcn.004aa218
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 2
call fcn.004aa17c
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.004a2894
mov byte [ebp - 4], 0
lea ecx, [esi + 0x30]
call sub.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_
lea ecx, [esi + 0x20]
call fcn.004014d2
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x499321
Capabilities:
Delete file

Disassembly:
mov eax, 0x4e5191
call fcn.004d1d50
sub esp, 0x4c
mov eax, dword [0x52e400]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x30]
xor ebx, ebx
lea ecx, [esi + 0xc8]
push eax
mov dword [ebp - 4], ebx
call fcn.00496138
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [esi + 0xcc]
mov ecx, dword [ebp - 0x30]
cmp ecx, eax
jne 0x499382
xor al, al
jmp 0x499462
push edi
mov edi, dword [ecx + 0x28]
mov ecx, edi
call fcn.0040644b
cmp eax, 2
jne 0x499399
xor al, al
jmp 0x499461
mov ecx, esi
call fcn.004981e7
inc dword [esi + 0x2a8]
mov ecx, edi
mov dword [ebp - 0x3c], eax
call fcn.004a5ea8
test eax, eax
mov dword [ebp - 0x38], eax
jbe 0x4993f9
push ebx
mov ecx, edi
call fcn.004a5f0a
cmp eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jne 0x4993d6
push 0x500a80
mov ecx, esi
call fcn.00498b9a
mov eax, dword [ebp - 0x34]
mov ecx, eax
call fcn.004a666f
push eax
lea ecx, [esi + 0x1e4]
call fcn.004a1b60
push dword [ebp - 0x34]
mov ecx, esi
call fcn.00496ed8
inc ebx
cmp ebx, dword [ebp - 0x38]
jb 0x4993b7
mov ecx, edi
call fcn.004a5dc7
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push eax
lea ecx, [esi + 0xc8]
mov dword [ebp - 4], 1
call fcn.00496b08
test edi, edi
je 0x499435
mov ecx, edi
call fcn.004a6202
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
cmp byte [ebp + 0xc], 0
je 0x49944b
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00496e86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret 8
Function at 0x49933c
Capabilities:
Delete file

Disassembly:
mov eax, 0x4e5191
call fcn.004d1d50
sub esp, 0x4c
mov eax, dword [0x52e400]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push eax
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x30]
xor ebx, ebx
lea ecx, [esi + 0xc8]
push eax
mov dword [ebp - 4], ebx
call fcn.00496138
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [esi + 0xcc]
mov ecx, dword [ebp - 0x30]
cmp ecx, eax
jne 0x499382
xor al, al
jmp 0x499462
push edi
mov edi, dword [ecx + 0x28]
mov ecx, edi
call fcn.0040644b
cmp eax, 2
jne 0x499399
xor al, al
jmp 0x499461
mov ecx, esi
call fcn.004981e7
inc dword [esi + 0x2a8]
mov ecx, edi
mov dword [ebp - 0x3c], eax
call fcn.004a5ea8
test eax, eax
mov dword [ebp - 0x38], eax
jbe 0x4993f9
push ebx
mov ecx, edi
call fcn.004a5f0a
cmp eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
jne 0x4993d6
push 0x500a80
mov ecx, esi
call fcn.00498b9a
mov eax, dword [ebp - 0x34]
mov ecx, eax
call fcn.004a666f
push eax
lea ecx, [esi + 0x1e4]
call fcn.004a1b60
push dword [ebp - 0x34]
mov ecx, esi
call fcn.00496ed8
inc ebx
cmp ebx, dword [ebp - 0x38]
jb 0x4993b7
mov ecx, edi
call fcn.004a5dc7
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push eax
lea ecx, [esi + 0xc8]
mov dword [ebp - 4], 1
call fcn.00496b08
test edi, edi
je 0x499435
mov ecx, edi
call fcn.004a6202
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
cmp byte [ebp + 0xc], 0
je 0x49944b
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00496e86
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret 8
Function at 0x49a116
Capabilities:
Check if file exists
Copy file

Disassembly:
mov eax, 0x4e52a6
call fcn.004d1d50
sub esp, 0x228
mov eax, dword [0x52e400]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
test esi, esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
je 0x49a16a
push esi
call fcn.004a1ed6
test al, al
pop ecx
jne 0x49a171
push 0
push 0
push esi
mov ecx, ebx
call fcn.0049838b
test eax, eax
je 0x49a16a
mov ecx, eax
call fcn.004a666f
push eax
mov ecx, ebx
call fcn.00498b9a
jmp 0x49a261
xor al, al
jmp 0x49a261
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
test edi, edi
jne 0x49a186
xor al, al
jmp 0x49a260
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
and dword [ebp - 4], 0
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.MSVCR71.dll_wcslen]
pop ecx
push eax
push edi
call fcn.0044f9bd
add esp, 0xc
push edi
mov ecx, ebx
call fcn.00495883
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49a20a
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, ebx
call fcn.004966bd
test eax, eax
je 0x49a1f2
mov bl, 1
jmp 0x49a24e
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, ebx
call fcn.0049726a
mov bl, al
jmp 0x49a24e
push 0
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x49a24c
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, ebx
call fcn.0049726a
test al, al
je 0x49a24c
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
mov ecx, ebx
call fcn.00498f22
jmp 0x49a206
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, bl
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d1da7
leave
ret 4
Function at 0x49cdd8
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e5361
call fcn.004d1d50
sub esp, 0x2c
mov ecx, dword [ebp + 0xc]
push 0x4ec7ce
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x49ce07
xor al, al
jmp 0x49cedc
push ebx
lea ecx, [ebp - 0x38]
call fcn.0040f3ff
xor ebx, ebx
push ebx
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0040f969
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.0040f9bf
test al, al
lea ecx, [ebp - 0x34]
jne 0x49ce3e
call fcn.0040e35c
mov byte [ebp + 0xb], bl
jmp 0x49cecc
push edi
call fcn.0040e35c
lea ecx, [ebp - 0x38]
call fcn.00446f58
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, ebx
mov byte [ebp - 4], 1
jne 0x49ce5e
mov byte [ebp + 0xb], bl
jmp 0x49cecb
lea ecx, [edi + 0x30]
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
cmp eax, ebx
je 0x49cebe
push str.info
push eax
call sub.MSVCR71.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x49cebe
push esi
push ebx
mov ecx, edi
call fcn.00449647
mov esi, eax
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP71.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, esi
call fcn.0040ee62
mov ecx, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x49ceb7
mov ecx, esi
call fcn.0040de1d
mov byte [ebp + 0xb], 1
pop esi
jmp 0x49cec1
mov byte [ebp + 0xb], bl
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0040de1d
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040ee8c
mov al, byte [ebp + 0xb]
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8

Function at 0x49ebe9
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov ecx, dword [esi + 4]
call fcn.0049d2b4
test al, al
je 0x49ec38
mov ecx, dword [esi + 4]
call fcn.0049ebad
push esi
mov ecx, edi
call fcn.0049d862
test al, al
je 0x49ec27
mov ecx, dword [esi + 4]
add ecx, 0xbc
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 4]
mov dword [eax + 0x98], 4
xor al, al
jmp 0x49ec3a
mov al, 1
pop edi
pop esi
ret 4