joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de500
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc9b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._s_shsvcs.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_shsvcs.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_shsvcs.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4de5b7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4de5dd
mov edi, 1
cmp ebx, 1
jne 0x4de612
cmp edi, esi
jne 0x4de6f6
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4de655
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4de686
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4de68b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4de6aa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4de6af
mov esi, 1
cmp edi, 1
jne 0x4de6e0
test esi, esi
jne 0x4de6e0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de730
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc9c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._slpk.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bklpk.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachelpk.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4de7e7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4de80d
mov edi, 1
cmp ebx, 1
jne 0x4de842
cmp edi, esi
jne 0x4de926
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4de885
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4de8b6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4de8bb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4de8da
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4de8df
mov esi, 1
cmp edi, 1
jne 0x4de910
test esi, esi
jne 0x4de910
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de960
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc9d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._s_rpcss.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_rpcss.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_rpcss.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dea17
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dea3d
mov edi, 1
cmp ebx, 1
jne 0x4dea72
cmp edi, esi
jne 0x4deb56
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4deab5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4deae6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4deaeb
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4deb0a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4deb0f
mov esi, 1
cmp edi, 1
jne 0x4deb40
test esi, esi
jne 0x4deb40
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4deb90
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc9e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._skernel32.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkkernel32.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachekernel32.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dec47
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dec6d
mov edi, 1
cmp ebx, 1
jne 0x4deca2
cmp edi, esi
jne 0x4ded86
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4dece5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4ded16
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4ded1b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4ded3a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4ded3f
mov esi, 1
cmp edi, 1
jne 0x4ded70
test esi, esi
jne 0x4ded70
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dedc0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc9f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._suxtheme.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bkuxtheme.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcacheuxtheme.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dee77
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4dee9d
mov edi, 1
cmp ebx, 1
jne 0x4deed2
cmp edi, esi
jne 0x4defb6
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4def15
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4def46
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4def4b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4def6a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4def6f
mov esi, 1
cmp edi, 1
jne 0x4defa0
test esi, esi
jne 0x4defa0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4deff0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fca00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._s_sfc.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_sfc.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_sfc.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df0a7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df0cd
mov edi, 1
cmp ebx, 1
jne 0x4df102
cmp edi, esi
jne 0x4df1e6
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4df145
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4df176
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4df17b
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4df19a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4df19f
mov esi, 1
cmp edi, 1
jne 0x4df1d0
test esi, esi
jne 0x4df1d0
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4df220
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fca10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._s_sfc_os.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bk_sfc_os.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcache_sfc_os.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df2d7
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df2fd
mov edi, 1
cmp ebx, 1
jne 0x4df332
cmp edi, esi
jne 0x4df416
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4df375
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4df3a6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4df3ab
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4df3ca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4df3cf
mov esi, 1
cmp edi, 1
jne 0x4df400
test esi, esi
jne 0x4df400
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4df450
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fca20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38c
push ebx
push esi
push edi
lea eax, [ebp - 0x98]
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x80
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x198]
push ecx
push str._slinkinfo.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x298]
push eax
push str._sdllcache_bklinkinfo.dll
push ecx
call fcn.004f175f
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x398]
push edx
push str._sdllcachelinkinfo.dll
push eax
call fcn.004f175f
push str.c:endpcache
xor ebx, ebx
xor edi, edi
call fcn.004f2beb
lea ecx, [ebp - 0x198]
push ecx
call fcn.004bd410
add esp, 0x2c
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df507
mov ebx, 1
lea edx, [ebp - 0x298]
push edx
call fcn.004bd410
add esp, 4
push 0x5144fc
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4df52d
mov edi, 1
cmp ebx, 1
jne 0x4df562
cmp edi, esi
jne 0x4df646
lea eax, [ebp - 0x298]
push esi
lea ecx, [ebp - 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 1
jne 0x4df5a5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call edi
lea ecx, [ebp - 0x198]
push esi
lea edx, [ebp - 0x298]
push ecx
push edx
call edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
lea edx, [ebp - 0x198]
push ecx
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
xor edi, edi
call ebx
test eax, eax
jne 0x4df5d6
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x4df5db
mov edi, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x298]
push edx
push eax
call ebx
test eax, eax
jne 0x4df5fa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
je 0x4df5ff
mov esi, 1
cmp edi, 1
jne 0x4df630
test esi, esi
jne 0x4df630
lea edx, [ebp - 0x198]
push esi
lea eax, [ebp - 0x298]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x198]
push 0
lea edx, [ebp - 0x398]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret