joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a4e0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00419530
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 0
push 0x19
lea edx, [ebp - 0x20c]
push edx
push 0
call edi
push 0x48b778
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00410d07
push esi
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.00410d07
push str..lnk
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.00410d07
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0040a780
test al, al
jne 0x40a5c7
xor ecx, ecx
push ecx
push 0x19
lea edx, [ebp - 0x20c]
push edx
push ecx
mov word [ebp - 0x20c], cx
call edi
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x1005
push 0x8000000
call esi
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x1005
push 0x80001000
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret

Function at 0x40a5e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00419530
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 0
push 0x17
lea edx, [ebp - 0x20c]
push edx
push 0
call edi
push 0x48b778
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00410d07
push esi
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.00410d07
add esp, 0x18
lea ecx, [ebp - 0x20c]
call fcn.0040a6c0
xor edx, edx
push edx
push 0x17
lea eax, [ebp - 0x20c]
push eax
push edx
mov word [ebp - 0x20c], dx
call edi
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x1005
push InitCommonControls
call esi
push 0
lea edx, [ebp - 0x20c]
push edx
push 0x1005
push 0x80001000
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret

Function at 0x40a780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push str.SoftwareEDataStore
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40a7db
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.EnableLoginAuth
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], ebx
mov edx, dword [ebp - 8]
push edx
setne bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b2d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474e96
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 5
mov esi, ecx
xor eax, eax
mov edi, 7
xor ebx, ebx
push str.app
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x240], ebx
mov word [ebp - 0x250], ax
call fcn.00401540
mov dword [ebp - 4], ebx
xor ecx, ecx
push 5
mov word [ebp - 0x234], cx
push str.sys
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], ebx
call fcn.00401540
mov byte [ebp - 4], 1
cmp dword [ebp - 0x23c], 8
mov eax, dword [ebp - 0x250]
jae 0x40b371
lea eax, [ebp - 0x250]
mov edi, dword [ebp - 0x240]
push edi
push eax
push esi
call fcn.0040b4c0
cmp eax, 0xffffffff
je 0x40b39a
push 0xffffffffffffffff
push ebx
push 0x49c530
push edi
push eax
mov ecx, esi
call fcn.00403f70
jmp 0x40b41a
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x40b3af
lea eax, [ebp - 0x234]
mov edx, dword [ebp - 0x224]
push edx
push eax
push esi
call fcn.0040b4c0
mov edi, eax
cmp edi, 0xffffffff
je 0x40b41a
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00419530
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40b3f4
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x218]
push edx
push eax
push edi
mov ecx, esi
call fcn.00403c50
mov esi, 8
cmp dword [ebp - 0x220], esi
jb 0x40b436
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.0040f3f1
add esp, 4
xor edx, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], ebx
mov word [ebp - 0x234], dx
cmp dword [ebp - 0x23c], esi
jb 0x40b466
mov eax, dword [ebp - 0x250]
push eax
call fcn.0040f3f1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret
Function at 0x40c330
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47539b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x68
lea esi, [ebp - 0x250]
call fcn.0040ab00
add esp, 4
mov edi, eax
push 0x6c
lea esi, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.0040ab00
mov esi, 8
add esp, 4
cmp dword [edi + 0x14], esi
jb 0x40c393
mov edi, dword [edi]
cmp dword [eax + 0x14], esi
jb 0x40c39a
mov eax, dword [eax]
push 0x24
push edi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete bl
cmp dword [ebp - 0x220], esi
jb 0x40c3c3
mov eax, dword [ebp - 0x234]
push eax
call fcn.0040f3f1
add esp, 4
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], cx
cmp dword [ebp - 0x23c], esi
jb 0x40c3fe
mov edx, dword [ebp - 0x250]
push edx
call fcn.0040f3f1
add esp, 4
test bl, bl
je 0x40c444
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00419530
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push 0
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.00409fc0
jmp 0x40c449
call fcn.00409ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret
Function at 0x40cf50
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47515b
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
fld dword [ebp + 8]
fld qword [0x48bfc8]
fmul st(1), st(0)
faddp st(1)
call fcn.0046a330
push eax
mov eax, dword [edi]
mov ecx, dword [eax]
call fcn.00429d87
fld dword [ebp + 8]
fld1
fucompp
fnstsw ax
test ah, 0x44
jp 0x40d137
xor esi, esi
mov dword [ebp - 0x360], esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFC35EB43_F4A0_43B4_BEB1_66A470045416_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [edi + 4]
push esi
push esi
call fcn.0042467e
lea ecx, [ebp - 0x358]
push ecx
call fcn.0040bfc0
mov dword [ebp - method.CPageDialog1.virtual_0], 0x48becc
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], 0x48bf5c
mov dword [ebp - fcn.00426267], 0x48bf64
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], 0x48bf6c
mov dword [ebp - method.DuiLib::CTxtWinHost.virtual_88], 0x48bf74
mov ebx, 1
push 0x68
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0040ab00
add esp, 4
mov esi, 8
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], esi
jb 0x40d033
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [ebp - 0x358]
call fcn.00424c48
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], esi
jb 0x40d075
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0040f3f1
add esp, 4
lea ecx, [ebp - 0x358]
call fcn.00424792
lea ecx, [ebp - 0x358]
call fcn.004246b9
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x35c]
push ecx
push str.SoftwareEDataStore
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [0x49e2a4], bl
mov byte [eax + 0x34c], bl
mov dword [ebp - 0x35c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40d0de
mov edx, dword [ebp - 0x35c]
push str.LanguageID
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x35c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [edi + 4]
push ebx
call fcn.00424b04
mov dword [ebp - method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [ebp - method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [ebp - fcn.00426267], vtable.DuiLib::WindowImplBase.2.0
mov dword [ebp - method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [ebp - method.DuiLib::CTxtWinHost.virtual_88], vtable.DuiLib::WindowImplBase.4.0
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 3
call fcn.00427fa8
lea ecx, [ebp - 0x344]
mov byte [ebp - 4], 0
call fcn.00425905
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ecc7
mov esp, ebp
pop ebp
ret 4
Function at 0x40e920
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4712e0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x499694]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x49cb3c]
test eax, eax
jne 0x40e954
xor esi, esi
jmp 0x40e95d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x30], 0
test esi, esi
je 0x40e9a7
cmp dword [esi + 0x14], 0
jne 0x40e9e9
cmp dword [esi + 0x10], 0
jne 0x40e9f0
push 0x40e430
push 0x49cb34
call fcn.0040e630
mov eax, dword [0x49cb3c]
add esp, 8
test eax, eax
je 0x40ea9d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x30], 0xffffffff
test esi, esi
je 0x40e9d5
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40e9d5
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp dword [esi + 0x10], 0
je 0x40ea30
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x40ea1e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x40e9f0
cmp dword [esi + 0x14], 0
je 0x40e979
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40ea55
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x40ea86
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40ea86
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40ea86
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x40ea3a
jmp 0x40e973
lea ecx, [esp + 0x18]
call fcn.0040ecd6
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x34], 1
call fcn.00401960
int3
Function at 0x40eb90
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x471338
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x499694]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x40ead0
push 0
push 0
call fcn.00415fbf
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x40ebfb
lea ecx, [esp + 0x10]
call fcn.0040ecd6
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.00401960
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x40ec1e
cmp eax, 0xffffffff
je 0x40ec1e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x40ecc7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x499694]
jne 0x40ecd1
repz ret
jmp fcn.0041605f
Function at 0x41cfde
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x499694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00418bea
and dword [ebp - 0x14], 0
cmp dword [0x49d8c4], 0
mov dword [ebp - 0x18], eax
jne 0x41d091
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41d139
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47fd40
push ebx
call edi
test eax, eax
je 0x41d139
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49d8c4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49d8c8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49d8cc], eax
call edi
push eax
call esi
mov dword [0x49d8d4], eax
test eax, eax
je 0x41d091
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49d8d0], eax
mov eax, dword [0x49d8d0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41d0ea
cmp dword [0x49d8d4], ecx
je 0x41d0ea
push eax
call esi
push dword [0x49d8d4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41d0ea
test ebx, ebx
je 0x41d0ea
call edi
test eax, eax
je 0x41d0e1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41d0e1
test byte [ebp - 8], 1
jne 0x41d0ea
or dword [ebp + 0x10], 0x200000
jmp 0x41d11d
mov eax, dword [0x49d8c8]
cmp eax, dword [ebp - 0x18]
je 0x41d11d
push eax
call esi
test eax, eax
je 0x41d11d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41d11d
mov eax, dword [0x49d8cc]
cmp eax, dword [ebp - 0x18]
je 0x41d11d
push eax
call esi
test eax, eax
je 0x41d11d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49d8c4]
call esi
test eax, eax
je 0x41d139
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41d13b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ecc7
leave
ret
Function at 0x4206f0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x47142b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x499694]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x499694]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a8]
mov ebx, dword [esp + 0x2a0]
mov esi, dword [esp + 0x2ac]
mov ebp, dword [esp + 0x2b0]
push 0xffffffffffffffff
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a8]
push edi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
call fcn.004013e0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x294], edi
cmp eax, edi
je 0x4207d4
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
cmp edi, 8
jae 0x4207a1
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4207cd
mov edx, ecx
cmp edi, 8
jae 0x4207b4
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x2f
je 0x4207cd
cmp edi, 8
jae 0x4207c5
lea ecx, [esp + 0x1c]
cmp word [ecx + eax*2 - 2], 0x3a
jne 0x4207d4
mov edx, 0x480548
jmp 0x4207d9
mov edx, 0x480540
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4207e0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00402af0
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x42080d
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x42086b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], 0
call edi
cmp eax, 2
je 0x420840
call edi
cmp eax, 0x12
je 0x420840
call edi
mov esi, eax
jmp 0x420842
xor esi, esi
call fcn.00423650
cmp dword [esp + 0x30], 8
mov edi, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
jb 0x420864
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040f3f1
add esp, 4
mov eax, edi
jmp 0x4208f1
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420872
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x68]
push eax
call fcn.00401540
mov eax, dword [esp + 0x38]
test eax, 0x400
je 0x4208aa
mov dword [esi], 0
mov dword [ebp], 0
jmp 0x4208ca
test al, 0x10
je 0x4208bd
mov dword [esi], 3
mov dword [ebp], 3
jmp 0x4208ca
mov dword [esi], 2
mov dword [ebp], 2
mov esi, dword [esp + 0x14]
mov dword [esi], 0
call fcn.00423650
mov dword [esi + 4], eax
cmp dword [esp + 0x30], edi
jb 0x4208ef
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040f3f1
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.0040ecc7
add esp, 0x284
ret
Function at 0x4211a0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x471550
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x499694]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x499694]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x64]
cmp eax, 1
jne 0x4211fb
test edi, edi
je 0x4211f4
mov dword [edi], 0
call fcn.00423650
mov dword [edi + 4], eax
xor al, al
jmp 0x4212fa
cmp eax, 3
je 0x421284
cmp eax, 0xb
je 0x421284
push 0x19
push str.boost::filesystem::remove
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00407670
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], 1
jb 0x421240
mov eax, dword [esi]
jmp 0x421242
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
lea ecx, [esp + 0x10]
push ecx
sete dl
push edi
movzx eax, dl
push esi
push eax
call fcn.00421060
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x42127c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040f3f1
add esp, 4
test bl, bl
je 0x4212f8
xor al, al
jmp 0x4212fa
push 0x19
xor ebx, ebx
push str.boost::filesystem::remove
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00407670
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], ebx
jb 0x4212b4
mov eax, dword [esi]
jmp 0x4212b6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
lea edx, [esp + 0x2c]
push edx
test al, al
sete al
push edi
movzx ecx, al
push esi
push ecx
call fcn.00421060
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x4212f0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0040f3f1
add esp, 4
test bl, bl
jne 0x4211f4
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0040ecc7
add esp, 0x48
ret

Function at 0x421440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [ebx + 0x14], 8
push edi
jb 0x421450
mov eax, dword [ebx]
jmp 0x421452
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x421478
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.00421320
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42148f
mov dword [esi], 0
call fcn.00423650
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x4214c2
push ebx
call fcn.004201f0
add esp, 4
test al, al
je 0x4214ba
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
ret
pop edi
mov eax, 9
pop ebx
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
ret