joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d3e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.0043d0fa
pop ecx
test al, al
je 0x43d4d4
push edi
push 0xffffffffffffffff
push 0x4c69b4
lea ecx, [ebp - 0x74]
call fcn.00446ad9
mov eax, dword [0x4c69e0]
cmp dword [eax - 0xc], edi
je 0x43d437
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.00437b63
mov eax, esi
jmp 0x43d503
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.004501b0
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.0043d07e
add esp, 0x18
test eax, eax
je 0x43d464
xor esi, esi
jmp 0x43d428
push ebx
mov esi, 0x4c69e0
push 0x105
mov ecx, esi
call fcn.0040136b
push edi
push 0x23
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d4ac
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x43d4aa
push dword [0x4c69d4]
push ebx
call edi
test eax, eax
je 0x43d4aa
xor edi, edi
inc edi
jmp 0x43d4ac
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040859a
pop ebx
test edi, edi
je 0x43d4c5
mov esi, dword [0x4c69e0]
jmp 0x43d428
mov ecx, esi
call fcn.00401537
lea ecx, [ebp - 0x74]
call fcn.00437b63
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43d501
test byte [eax + 0x1c], 1
je 0x43d501
cmp byte [eax + 0x19], 2
jb 0x43d501
push 0x4a3754
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044fc8e
leave
ret

Function at 0x43d86a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x43d89a
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
mov esi, eax
and esi, 0xff
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4a39e0]
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x43d876
pop esi
not eax
ret
Function at 0x43d89d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00458750
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
or dword [edi], 0xffffffff
mov dword [ebp - 0x2008], eax
mov esi, dword [ebp + 0x14]
mov eax, 0x2000
cmp esi, eax
jbe 0x43d8d6
mov esi, eax
jmp 0x43d8da
test esi, esi
je 0x43d932
mov ecx, dword [ebp - 0x2008]
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0043bccc
test eax, eax
je 0x43d939
xor ecx, ecx
test esi, esi
jbe 0x43d922
mov eax, dword [edi]
movzx edx, byte [ebp + ecx - 0x2004]
mov ebx, eax
and ebx, 0xff
xor edx, ebx
shr eax, 8
xor eax, dword [edx*4 + 0x4a39e0]
inc ecx
mov dword [edi], eax
cmp ecx, esi
jb 0x43d8fd
xor eax, eax
sub dword [ebp + 0x14], esi
sbb dword [ebp + 0x18], eax
add dword [ebp + 0xc], esi
adc dword [ebp + 0x10], eax
jmp 0x43d8c6
not dword [edi]
xor eax, eax
inc eax
jmp 0x43d968
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43d966
test byte [eax + 0x1c], 1
je 0x43d966
cmp byte [eax + 0x19], 2
jb 0x43d966
push 0x4a39d0
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fc8e
leave
ret
Function at 0x43ed2c
Capabilities:
Get system information on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0043ea88
mov ecx, dword [0x4c69e8]
test ecx, ecx
jne 0x43ed4f
push 0x4c69e4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x4c69e8]
mov eax, dword [esp + 8]
xor edx, edx
div ecx
push ebx
xor ebx, ebx
push 4
cmp ebx, edx
sbb edx, edx
imul eax, ecx
and edx, ecx
add edx, eax
pop eax
push eax
push 0x1000
push edx
push ebx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0xc], eax
pop ebx
test eax, eax
jne 0x43edb9
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43edb1
test byte [eax + 0x1c], 1
je 0x43edb1
cmp byte [eax + 0x19], 2
jb 0x43edb1
push 0x4a406c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
and dword [esi + 8], 0
and dword [esi + 4], 0
mov eax, dword [esi + 0xc]
pop esi
ret 4
Function at 0x44024e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x228
lea ebp, [esp - 4]
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp + 0x228], eax
push 0x30
mov eax, 0x499fed
call fcn.00454d31
mov eax, dword [ebp + 0x234]
xor ebx, ebx
push ebx
push 0x43f940
push 8
push 0x3b
push 0x4a4a08
push eax
mov edi, ecx
call fcn.00458ca5
add esp, 0x18
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.0043d9d0
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x440300
mov esi, dword [esi + 4]
cmp esi, 0xf0000000
je 0x44033b
cmp esi, 0xf0000001
je 0x440334
lea eax, [ebp]
push eax
push 1
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x44032f
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x440300
test byte [eax + 0x1c], 1
je 0x440300
cmp byte [eax + 0x19], 2
jb 0x440300
push 0x4a49f8
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x34]
call fcn.0043d9b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x228]
xor ecx, ebp
call fcn.0044fc8e
add ebp, 0x22c
leave
ret
lea eax, [ebp]
jmp 0x440340
call fcn.0043d2c1
jmp 0x440340
call fcn.0043d3e9
push eax
mov ecx, edi
call fcn.004084de
xor esi, esi
inc esi
jmp 0x440302
Function at 0x441ae6
Capabilities:
Get common file path

Disassembly:
push 0x58
mov eax, 0x49a111
call fcn.00454d9d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
call fcn.0043d9d0
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 0x35], 1
mov byte [ebp - 4], 1
call fcn.0040136b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.0040859a
test ebx, ebx
je 0x441b31
cmp ebx, esi
jbe 0x441b6e
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x441b6a
test byte [eax + 0x1c], 1
je 0x441b6a
cmp byte [eax + 0x19], 2
jb 0x441b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x4c6094]
push 0x4a4cf4
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0043d9a3
test al, al
je 0x441b7e
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x5c]
call fcn.0043d9b0
mov al, byte [ebp - 0x35]
call fcn.00454df9
ret
Function at 0x44abad
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
movzx eax, word [edi]
xor esi, esi
test ax, ax
je 0x44abe6
movzx eax, ax
movzx eax, ax
inc edi
push eax
inc edi
call fcn.0045931d
movzx eax, ax
add eax, esi
imul eax, eax, 0x401
mov esi, eax
shr eax, 6
xor esi, eax
movzx eax, word [edi]
pop ecx
test ax, ax
jne 0x44abc0
imul esi, esi, 9
mov eax, esi
shr eax, 0xb
xor eax, esi
pop edi
imul eax, eax, 0x8001
pop esi
ret

Function at 0x44c02e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.0044bff7
mov ecx, edi
call fcn.0044e116
mov esi, eax
cmp esi, 1
je 0x44c096
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x44c13d
test byte [eax + 0x1c], 1
je 0x44c13d
cmp byte [eax + 0x19], 2
jb 0x44c13d
push 0x4a5e04
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
jmp 0x44c13d
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x44c0de
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x44c0d9
test byte [eax + 0x1c], 1
je 0x44c0d9
cmp byte [eax + 0x19], 2
jb 0x44c0d9
push 0x4a5e04
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
push 2
pop esi
jmp 0x44c142
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x4a5f0c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea ecx, [edi + 0x38]
call fcn.0044bef7
test al, al
jne 0x44c149
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x44c13a
test byte [eax + 0x1c], 1
je 0x44c13a
cmp byte [eax + 0x19], 2
jb 0x44c13a
push 0x4a5e04
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
push 4
pop esi
cmp esi, 1
je 0x44c149
mov ecx, edi
call fcn.0044bff7
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044fc8e
leave
ret
Function at 0x44fb8b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.0044fb62
push 0x105
lea eax, [ebp - 0x210]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x44fbf1
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x44fbed
test byte [eax + 0x1c], 1
je 0x44fbed
cmp byte [eax + 0x19], 2
jb 0x44fbed
push 0x4a61c4
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
push 2
jmp 0x44fc4f
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x4a64c0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea ecx, [edi + 4]
call fcn.0044fa28
test al, al
jne 0x44fc57
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x44fc4d
test byte [eax + 0x1c], 1
je 0x44fc4d
cmp byte [eax + 0x19], 2
jb 0x44fc4d
push 0x4a61c4
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
push 4
pop esi
mov ecx, edi
call fcn.0044fb62
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044fc8e
leave
ret

Function at 0x44fc8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3360]
jne 0x44fc98
repz ret
jmp fcn.00459330

Function at 0x457cfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x457d2d
call fcn.00456976
mov dword [eax], esi
call fcn.00456963
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00450931
add esp, 0x14
push 0x16
pop eax
jmp 0x457d82
test dword [ebp + 0xc], 0xfffffff9
jne 0x457d09
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x457d5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00456989
pop ecx
call fcn.00456963
mov eax, dword [eax]
jmp 0x457d82
test al, 0x10
jne 0x457d80
test al, 1
je 0x457d80
test byte [ebp + 0xc], 2
je 0x457d80
call fcn.00456976
mov dword [eax], 5
call fcn.00456963
mov dword [eax], 0xd
jmp 0x457d51
xor eax, eax
pop esi
pop ebp
ret
Function at 0x467677
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045c735
and dword [ebp - 4], 0
cmp dword [0x4c8464], 0
mov ebx, eax
jne 0x467728
push 0x4a878c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4677d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a8780
push edi
call esi
test eax, eax
je 0x4677d9
push eax
call fcn.0045c6c3
mov dword [esp], 0x4a8770
push edi
mov dword [0x4c8464], eax
call esi
push eax
call fcn.0045c6c3
mov dword [esp], 0x4a875c
push edi
mov dword [0x4c8468], eax
call esi
push eax
call fcn.0045c6c3
mov dword [esp], 0x4a8740
push edi
mov dword [0x4c846c], eax
call esi
push eax
call fcn.0045c6c3
pop ecx
mov dword [0x4c8474], eax
test eax, eax
je 0x467728
push 0x4a8728
push edi
call esi
push eax
call fcn.0045c6c3
pop ecx
mov dword [0x4c8470], eax
mov eax, dword [0x4c8470]
cmp eax, ebx
je 0x467780
cmp dword [0x4c8474], ebx
je 0x467780
push eax
call fcn.0045c73e
push dword [0x4c8474]
mov esi, eax
call fcn.0045c73e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x467780
test edi, edi
je 0x467780
call esi
test eax, eax
je 0x467777
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x467777
test byte [ebp - 0xc], 1
jne 0x467780
or dword [ebp + 0x10], 0x200000
jmp 0x4677b9
mov eax, dword [0x4c8468]
cmp eax, ebx
je 0x4677b9
push eax
call fcn.0045c73e
pop ecx
test eax, eax
je 0x4677b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4677b9
mov eax, dword [0x4c846c]
cmp eax, ebx
je 0x4677b9
push eax
call fcn.0045c73e
pop ecx
test eax, eax
je 0x4677b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c8464]
call fcn.0045c73e
pop ecx
test eax, eax
je 0x4677d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4677db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46d350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x49a938
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c3360]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x46cfe0
push 0x4c8494
call fcn.0046d1f0
mov eax, dword [0x4c8498]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x46d3bc
jmp 0x46d3b0
cmp dword [esi + 0x14], 0
jne 0x46d41e
cmp dword [esi + 0x10], 0
jne 0x46d424
push 0x46cfe0
push 0x4c8494
call fcn.0046d1f0
mov eax, dword [0x4c8498]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x46d40a
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x46d40a
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x46d464
mov ebx, dword [esi + 0x10]
mov ecx, dword [ebx + 4]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebx]
test ecx, ecx
je 0x46d452
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x46d424
cmp dword [esi + 0x14], 0
je 0x46d3b6
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x46d489
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x46d4ba
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x46d4ba
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x46d4ba
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x46d46e
jmp 0x46d3b0
Function at 0x46d570
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x46d4e0
push 0
push 0
call fcn.00498183
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x46d5b0
lea ecx, [esp + 8]
call fcn.0046cf60
push 0x4ba1b8
lea edx, [esp + 0xc]
push edx
call fcn.004548cc
mov eax, dword [edi + 8]
push esi
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x46d5d9
cmp eax, 0xffffffff
je 0x46d5d9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x46e130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
cmp dword [eax + 0x18], 8
jb 0x46e142
mov eax, dword [eax + 4]
jmp 0x46e145
add eax, 4
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46e1e6
push edi
mov edi, dword [0x4c84a4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], edi
cmp eax, 2
je 0x46e1c9
cmp eax, 3
je 0x46e1c9
cmp eax, 0x7b
je 0x46e1c9
cmp eax, 0x57
je 0x46e1c9
cmp eax, 0xa1
je 0x46e1c9
cmp eax, 0x35
je 0x46e1c9
cmp eax, 0x20
jne 0x46e1b8
lea ecx, [esp + 0xc]
call fcn.00410720
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x18]
pop edi
mov dword [esi + 4], edx
pop esi
mov dword [eax], 9
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0
pop ebx
add esp, 8
ret
xor edi, edi
call fcn.0046e3d0
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
pop esi
mov dword [eax], 1
pop ebx
add esp, 8
ret
xor esi, esi
call fcn.0046e3d0
mov ecx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 3
test bl, 0x10
jne 0x46e20f
mov dword [esp + 0x18], 2
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
pop esi
mov dword [eax], ecx
pop ebx
add esp, 8
ret

Function at 0x46e240
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.0046e3d0
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.0046e3d0
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x46e26b
mov eax, dword [edi + 4]
jmp 0x46e26e
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46e28f
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
mov ebp, dword [0x4c84a4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x46e2dc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.0046e130
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x46e2dc
xor esi, esi
call fcn.0046e3d0
mov ecx, eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
Function at 0x475fe0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
mov esi, ecx
push edi
mov ecx, ebp
call fcn.00474071
lea ecx, [esp + 0x10]
call fcn.00447b2c
push 0x4a5890
lea ecx, [esp + 0x14]
call fcn.00448297
mov edi, 0x4c6094
test al, al
jne 0x47603e
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x476043
test byte [eax + 0x1c], 1
je 0x476043
cmp byte [eax + 0x19], 2
jb 0x476043
push 0x4a9ad8
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
mov eax, dword [0x4c6094]
mov ecx, dword [esi + 0xb0]
xor ebx, ebx
xor edx, edx
inc ebx
sub ecx, edx
je 0x476105
dec ecx
je 0x4760c4
dec ecx
je 0x476083
cmp eax, edi
je 0x4761ca
test byte [eax + 0x1c], bl
je 0x4761ca
cmp byte [eax + 0x19], 2
jb 0x4761ca
push 0x4a9ad8
push 0x1b
jmp 0x4761bc
push ebp
push dword [esp + 0x6c]
mov ecx, esi
call fcn.0047527e
test eax, eax
jne 0x4761f3
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x4761ca
test byte [eax + 0x1c], 1
je 0x4761ca
cmp byte [eax + 0x19], 2
jb 0x4761ca
push 0x4a9ad8
push 0x1a
jmp 0x4761bc
push ebp
push dword [esp + 0x6c]
mov ecx, esi
call fcn.00475f62
test eax, eax
jne 0x4761f3
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x4761ca
test byte [eax + 0x1c], 1
je 0x4761ca
cmp byte [eax + 0x19], 2
jb 0x4761ca
push 0x4a9ad8
push 0x19
jmp 0x4761bc
cmp dword [esi + 0x70], edx
je 0x476188
push ebp
push dword [esp + 0x6c]
mov ecx, esi
call fcn.0047527e
test eax, eax
jne 0x4761f3
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x476148
test byte [eax + 0x1c], 1
je 0x476148
cmp byte [eax + 0x19], 2
jb 0x476148
push 0x4a9ad8
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
jne 0x4761f3
push ebp
push dword [esp + 0x6c]
mov ecx, esi
call fcn.00475f62
test eax, eax
jne 0x4761f3
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x4761ca
test byte [eax + 0x1c], 1
je 0x4761ca
cmp byte [eax + 0x19], 2
jb 0x4761ca
push 0x4a9ad8
push 0x16
jmp 0x4761bc
cmp dword [esi + 0xac], edx
je 0x4761ce
push ebp
push dword [esp + 0x6c]
mov ecx, esi
call fcn.00475f62
test eax, eax
jne 0x4761f3
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x4761ca
test byte [eax + 0x1c], 1
je 0x4761ca
cmp byte [eax + 0x19], 2
jb 0x4761ca
push 0x4a9ad8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
xor ebx, ebx
jmp 0x4761f3
cmp eax, edi
je 0x4761f3
test byte [eax + 0x1c], 1
je 0x4761f3
cmp byte [eax + 0x19], 2
jb 0x4761f3
push 0x4a9ad8
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.00447ed5
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x54
ret 8
Function at 0x482666
Capabilities:
Get common file path

Disassembly:
push 0x54
mov eax, 0x49b7d6
call fcn.00454d9d
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
call fcn.0043d9d0
and dword [ebp - 4], 0
mov esi, 0x104
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040136b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.0040859a
test ebx, ebx
je 0x4826b1
cmp ebx, esi
jb 0x482769
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x4826e8
test byte [eax + 0x1c], 1
je 0x4826e8
cmp byte [eax + 0x19], 2
jb 0x4826e8
push esi
push ebx
push 0x4aaa88
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004898cd
add esp, 0x18
test esi, esi
jle 0x4826f8
and esi, 0xffff
or esi, 0x80070000
lea ecx, [ebp - 0x58]
call fcn.0043d9b0
mov eax, esi
call fcn.00454df9
ret
lea ecx, [ebp - 0x58]
call fcn.0043d9a3
test al, al
je 0x4827f9
mov esi, 0x8007000e
jmp 0x4826f8
xor esi, esi
jmp 0x4826f8