joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42243b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push esi
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4224b1
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x4224b1
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4224b1
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x4224aa
push ebx
push edi
push eax
call fcn.004887e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
jmp 0x4224b1
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42373e
Capabilities:
Check mutex on windows
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edi, ecx
push str.LocalOpera_Installer_UI_lock
push esi
mov dword [ebp - 0x40], esi
push esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], esi
call fcn.0041297a
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x42387c
cmp esi, 0xffffffff
je 0x42387c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push str.installer.lck
lea ecx, [ebp - 0x38]
call fcn.0040409d
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043c3e0
xor ebx, ebx
lea ecx, [ebp - 0x38]
push ebx
push 1
call fcn.00404402
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
push ebx
cmovae eax, dword [ebp - 0x20]
push 0x4000080
push 2
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 1
push 0x40000000
push eax
call ebx
push eax
lea ecx, [edi + 0x6c]
call fcn.0041297a
cmp dword [edi + 0x6c], 0
je 0x423816
cmp dword [edi + 0x6c], 0xffffffff
je 0x423816
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push 0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x3c]
push eax
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x423868
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 7
push SysReAllocString
push eax
call ebx
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], edi
call fcn.0041297a
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x423860
cmp eax, 0xffffffff
je 0x423860
push edi
lea ecx, [ebp - 0x48]
push ecx
push 4
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
lea ecx, [ebp - 0x44]
call fcn.0041327e
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x20]
call fcn.0043c140
push esi
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x42387f
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x40]
call fcn.0041327e
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00486d53
mov esp, ebp
pop ebp
ret 4
Function at 0x423d54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, edx
push edi
push 0
push 0
push 0x147
mov edi, ecx
push ebx
mov dword [ebp - 4], edi
call esi
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x423dae
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
push 2
pop edx
lea edi, [eax + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00483600
pop ecx
push edi
mov esi, eax
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [ebp - 4]
jmp 0x423de1
push 0
push eax
push 0x149
push ebx
call esi
xor ecx, ecx
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00483600
pop ecx
mov esi, eax
push esi
push dword [ebp - 8]
push 0x148
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov ecx, edi
call fcn.0040409d
test esi, esi
je 0x423df4
push esi
call fcn.004835e0
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4243a7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push esi
push 0x426443
push 0
push 0x65
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4243ce
xor al, al
pop esi
ret
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push esi
push 0x4261da
push dword [esi + 0xc]
push 0x8a
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [esi + 0x54], eax
test eax, eax
je 0x4243ca
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
xor ecx, ecx
cmp byte [eax + 0xf], cl
setne cl
push ecx
mov ecx, esi
call fcn.00424e77
push 5
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi + 4]
cmp dword [eax + 0x30], 0
jne 0x42443b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
xor eax, eax
cmp dword [esi + 0x54], eax
pop esi
setne al
ret
Function at 0x42779a
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x224c
call fcn.0048c180
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x220c], 0
lea eax, [ebp - 0x2248]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x3c
push 0
push eax
mov edi, ecx
call fcn.00488e30
lea eax, [ebp - 0x208]
mov dword [ebp - 0x2248], 0x3c
mov dword [ebp - 0x2238], eax
add esp, 0xc
cmp dword [esi + 0x14], 8
lea eax, [ebp - 0x2208]
mov dword [ebp - 0x221c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x2234], 0xff
mov dword [ebp - 0x2218], 0xfff
jb 0x427813
mov esi, dword [esi]
lea ecx, [ebp - 0x2248]
push ecx
push 0x90000000
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x42782f
xor al, al
jmp 0x42787d
mov eax, dword [ebp - 0x223c]
mov dword [edi], eax
lea eax, [ebp - 0x208]
push eax
call fcn.004038d1
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
lea ecx, [edi + 4]
call fcn.004046e6
lea eax, [ebp - 0x2208]
push eax
call fcn.004038d1
pop ecx
push eax
lea eax, [ebp - 0x2208]
push eax
lea ecx, [edi + 0x20]
call fcn.004046e6
movzx eax, word [ebp - 0x2230]
mov dword [edi + 0x1c], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00486d53
mov esp, ebp
pop ebp
ret 4
Function at 0x427a4a
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
lea edx, [edi + 0x20]
cmp dword [edx + 0x14], 8
jb 0x427a6b
mov edx, dword [edx]
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x2c]
push esi
sete cl
mov dword [ebp + 8], 0x800000
xor eax, eax
cmp dword [edi], 4
cmove eax, dword [ebp + 8]
or eax, 0x80000000
test cl, cl
push eax
push ebx
push ebx
push str.HTTP_1.1
push edx
mov edx, str.POST
mov eax, 0x4cdc68
cmove eax, edx
push eax
push dword [esi + 8]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
jne 0x427b06
call fcn.00438e90
cmp eax, 2
jg 0x427aef
xor ebx, ebx
inc ebx
call sub.KERNEL32.DLL_GetLastError
push eax
push 2
push 0x8b
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_3desktoplauncherinstallerwininetwininet.cc
lea ecx, [ebp - 0xc0]
call fcn.004384e0
add eax, 0x10
push str.Could_not_open_Request
push eax
call fcn.00404c5e
pop ecx
pop ecx
test bl, 1
je 0x427aff
lea ecx, [ebp - 0xc0]
call fcn.00438780
xor al, al
jmp 0x427b95
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x2c]
jne 0x427b21
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x427b1c
mov eax, dword [eax]
push ebx
push ebx
push ecx
jmp 0x427b39
mov ecx, dword [esi + 0x2c]
sub ecx, eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x427b34
mov eax, dword [eax]
push ecx
push dword [esi + 0x28]
push edi
push eax
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x427b93
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
je 0x427b93
call fcn.00438e90
cmp eax, 2
jg 0x427b8b
push 2
pop ebx
call sub.KERNEL32.DLL_GetLastError
push eax
push ebx
push 0x9c
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_3desktoplauncherinstallerwininetwininet.cc
lea ecx, [ebp - 0xc0]
call fcn.004384e0
add eax, 0x10
push str.Could_not_send_Request
push eax
call fcn.00404c5e
pop ecx
pop ecx
test bl, 2
jmp 0x427af2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42c189
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
call fcn.0042c1e1
test al, al
jne 0x42c1ca
push ebx
mov ebx, str.oauc_registry_mutex
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
jne 0x42c1c9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x42c1c9
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
mov dword [esi + 4], eax
pop ebx
mov ecx, esi
call fcn.0042c1e1
xor edx, edx
mov ecx, 0xffffff04
test al, al
pop esi
cmovne ecx, edx
mov eax, ecx
ret

Function at 0x42d0a2
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0xd], cl
push eax
push 0xa
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42d0d3
xor al, al
jmp 0x42d1ae
push ebx
push dword [ebp - 0x20]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.0041297a
cmp byte [ebp - 0xd], bl
je 0x42d13a
call fcn.0044d690
cmp eax, 3
jl 0x42d13a
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 0x12
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x42d1a3
cmp dword [ebp - 0x30], 3
jne 0x42d13a
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x13
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x42d1a3
push dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
call fcn.0041297a
lea eax, [ebp - 0x28]
push eax
push 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x42d1a3
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x42d19d
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x1c]
neg eax
sbb eax, eax
and dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x18]
cmp eax, 1
sete bl
lea ecx, [ebp - 0x14]
call fcn.0041327e
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486d53
mov esp, ebp
pop ebp
ret
Function at 0x42ded1
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push edi
mov edi, edx
test cl, cl
jne 0x42df37
push eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x20c], 0x101
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x42df14
xor al, al
jmp 0x42dfb8
lea eax, [ebp - 0x208]
push eax
call fcn.004038d1
pop ecx
push eax
lea eax, [ebp - 0x208]
mov ecx, edi
push eax
call fcn.004046e6
mov al, 1
jmp 0x42dfb8
push ebx
push esi
push eax
xor ebx, ebx
push ebx
push 2
pop esi
push esi
mov dword [ebp - 0x20c], ebx
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x42df62
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
je 0x42df62
xor al, al
jmp 0x42dfb6
mov eax, dword [ebp - 0x20c]
xor ecx, ecx
inc eax
mov dword [ebp - 0x20c], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00483600
pop ecx
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push esi
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x42dfa9
push esi
call fcn.004038d1
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004046e6
mov bl, 1
test esi, esi
je 0x42dfb4
push esi
call fcn.004835e0
pop ecx
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00486d53
mov esp, ebp
pop ebp
ret
Function at 0x430cca
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x4d5630]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov dword [esi], 0x4cfb14
cmp byte [esi + 0x34], bl
jne 0x430d0f
lea ecx, [esi + 0x38]
cmp dword [ecx], ebx
je 0x430de4
call fcn.0042d93f
jmp 0x430de4
call fcn.004312d4
cmp eax, 1
jl 0x430d52
push 0xffffffffffffffff
push 0x21
xor ebx, ebx
lea ecx, [esp + 0x18]
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_3desktoplauncherinstaller_service_transactionsdelete_file_operation.cc
inc ebx
call fcn.00438400
add eax, 8
lea edi, [esi + 0x1c]
push str.Actual_removal_of
push eax
call fcn.00404c5e
cmp dword [edi + 0x14], 8
pop ecx
pop ecx
jb 0x430d49
mov edi, dword [edi]
push edi
push eax
call fcn.00438950
pop ecx
pop ecx
test bl, 1
je 0x430d60
lea ecx, [esp + 0x10]
call fcn.00438510
lea edi, [esi + 0x1c]
push 1
push edi
call fcn.0043e7e0
pop ecx
pop ecx
test al, al
jne 0x430d78
push edi
call fcn.0043e7b0
pop ecx
cmp byte [esi + 0x36], 0
je 0x430de4
lea eax, [esp + 0xc4]
push eax
lea ecx, [esi + 4]
call fcn.0043ca90
cmp dword [esp + 0xd8], 8
lea eax, [esp + 0xc4]
cmovae eax, dword [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
lea ecx, [esp + 0xc4]
test eax, eax
je 0x430ddf
lea eax, [esp + 0xdc]
push eax
call fcn.0043ca90
push eax
lea ecx, [esp + 0xc8]
call fcn.0043c1e0
lea ecx, [esp + 0xdc]
call fcn.0043c140
jmp 0x430d8e
call fcn.0043c140
lea ecx, [esi + 0x38]
call fcn.0040962e
lea ecx, [esi + 0x1c]
call fcn.0043c140
lea ecx, [esi + 4]
call fcn.0043c140
mov ecx, dword [esp + 0xf4]
pop edi
mov dword [esi], 0x4ca338
pop esi
pop ebx
xor ecx, esp
call fcn.00486d53
mov esp, ebp
pop ebp
ret
Function at 0x438510
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 8]
push edi
call fcn.00414e82
add esp, 4
lea eax, [ebp - 0x41c]
lea esi, [ebx + 0xc]
mov ecx, esi
push eax
call fcn.0041317d
mov eax, dword [0x4d6f7c]
test eax, eax
je 0x438576
lea ecx, [ebp - 0x41c]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x438726
test byte [section..data], 2
je 0x43859c
cmp dword [ebp - 0x408], 0x10
lea eax, [ebp - 0x41c]
cmovae eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x4385a1
cmp dword [ebx], 2
jl 0x4385e4
cmp dword [ebp - 0x408], 0x10
lea edi, [ebp - 0x41c]
mov esi, dword [ebp - 0x40c]
cmovae edi, dword [ebp - 0x41c]
call fcn.0048816f
add eax, 0x40
push eax
push 1
push esi
push edi
call fcn.00489280
call fcn.0048816f
add eax, 0x40
push eax
call fcn.00488fea
lea edi, [ebx + 8]
add esp, 0x14
lea esi, [ebx + 0xc]
test byte [section..data], 1
je 0x43868e
push 0
push 0
call fcn.00439220
add esp, 8
cmp dword [0x4d6f8c], 0
jne 0x438616
push 0xffffffffffffffff
push dword [0x4d6f84]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
jmp 0x438621
mov ecx, dword [0x4d6f80]
call fcn.0043fcf0
call fcn.00439370
test al, al
je 0x43866c
push 2
push 0
push 0
push dword [0x4d6f70]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp dword [ebp - 0x408], 0x10
lea ecx, [ebp - 0x438]
push 0
push ecx
push dword [ebp - 0x40c]
lea eax, [ebp - 0x41c]
cmovae eax, dword [ebp - 0x41c]
push eax
push dword [0x4d6f70]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp dword [0x4d6f8c], 0
jne 0x438683
push dword [0x4d6f84]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x43868e
mov ecx, dword [0x4d6f80]
call fcn.0043fd00
cmp dword [ebx], 3
jne 0x438726
mov ecx, 0x400
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x40c], ecx
cmovb ecx, dword [ebp - 0x40c]
cmp dword [ebp - 0x408], 0x10
cmovae eax, dword [ebp - 0x41c]
test ecx, ecx
je 0x4386d2
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004887e0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call fcn.004534d0
add esp, 4
cmp dword [0x4d6f78], 0
je 0x438721
lea eax, [ebp - 0x434]
mov ecx, esi
push eax
call fcn.0041317d
lea eax, [ebp - 0x434]
push eax
call dword [0x4d6f78]
add esp, 4
cmp dword [ebp - 0x420], 0x10
jb 0x438726
push dword [ebp - 0x434]
call fcn.004835e0
add esp, 4
jmp 0x438726
call fcn.00449250
cmp dword [ebp - 0x408], 0x10
jb 0x43873d
push dword [ebp - 0x41c]
call fcn.004835e0
add esp, 4
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea esi, [edi + 0x50]
mov ecx, esi
call fcn.00412415
push esi
mov dword [esi], 0x4c7ff8
call fcn.004a940b
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00486d53
mov esp, ebp
pop ebp
ret
Function at 0x43e460
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0043d830
test al, al
jne 0x43e4d2
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0043d830
test al, al
jne 0x43e4d2
cmp dword [edi + 0x10], 0x104
jae 0x43e4d2
cmp dword [esi + 0x10], 0x104
jae 0x43e4d2
cmp dword [esi + 0x14], 8
jb 0x43e49b
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x43e4a3
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x43e4d2
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43e4d2
test al, 1
je 0x43e4cc
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
pop edi
mov al, 1
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret

Function at 0x43e4e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], 0
cmp dword [edi + 0x14], 8
jb 0x43e50a
mov ebx, dword [edi]
jmp 0x43e50c
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43e54c
test al, 0x10
je 0x43e52f
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486d53
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x43e539
mov dword [esi], 0xfffffff7
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486d53
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0043ca90
cmp dword [edi + 0x14], 8
jb 0x43e561
mov eax, dword [edi]
jmp 0x43e563
mov eax, edi
push dword [edi + 0x10]
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
push 0
call fcn.004130d3
test eax, eax
jne 0x43e586
test esi, esi
je 0x43e5d0
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x43e5d6
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0043e4e0
add esp, 8
test al, al
je 0x43e5d0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x43e5d4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x43e5c1
push edi
call fcn.0043e9d0
add esp, 4
test al, al
jne 0x43e5d4
test esi, esi
je 0x43e5d0
push ebx
call fcn.00454a60
add esp, 4
mov dword [esi], eax
xor bl, bl
jmp 0x43e5d6
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.0043c140
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00486d53
mov esp, ebp
pop ebp
ret
Function at 0x43e670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x4d5630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x468], 0
cmp dword [eax + 0x14], 8
jb 0x43e69c
mov eax, dword [eax]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0x4c7e30
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x43e6c6
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00486d53
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
cmp eax, 0x104
ja 0x43e750
test eax, eax
je 0x43e750
xor ecx, ecx
mov dword [ebp - 0x420], 7
push eax
lea eax, [ebp - 0x41c]
mov word [ebp - 0x434], cx
push eax
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x424], 0
call fcn.004046e6
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x44c]
call fcn.0043c0d0
push eax
mov ecx, esi
call fcn.0043c1e0
lea ecx, [ebp - 0x44c]
call fcn.0043c140
cmp dword [ebp - 0x420], 8
jb 0x43e79e
push dword [ebp - 0x434]
jmp 0x43e796
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x44c]
call fcn.0040409d
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x464]
call fcn.0043c0d0
push eax
mov ecx, esi
call fcn.0043c1e0
lea ecx, [ebp - 0x464]
call fcn.0043c140
cmp dword [ebp - 0x438], 8
jb 0x43e79e
push dword [ebp - 0x44c]
call fcn.004835e0
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00486d53
mov esp, ebp
pop ebp
ret