joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410440
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e569b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x16c], eax
lea eax, [esi + 0xc]
jne 0x410487
mov eax, dword [esi + 8]
push 0
push 0x80
push 3
push 0
push 7
push 0x100
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4104c1
mov edi, dword [ebp - 0x16c]
mov ecx, edi
push 0x50327c
call fcn.004062d0
jmp 0x41055f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x44]
movq qword [ebp - 0x174], xmm0
push eax
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.004e2109
mov eax, dword [ebp - 0x30]
add esp, 8
add eax, 0x76c
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x34]
inc eax
mov word [ebp - 0x1e], ax
movzx eax, word [ebp - 0x38]
mov word [ebp - 0x1a], ax
movzx eax, word [ebp - 0x2c]
mov word [ebp - 0x1c], ax
movzx eax, word [ebp - 0x3c]
mov word [ebp - 0x18], ax
movzx eax, word [ebp - 0x40]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 0x44]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x174]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
test eax, eax
jne 0x4105d0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x16c]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41056e
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x168]
add eax, 4
push 0
push eax
call fcn.0040f6f0
lea eax, [ebp - 0x168]
mov dword [ebp - 4], 0
push eax
push 0x50328c
mov ecx, edi
call fcn.00429910
mov ecx, eax
call fcn.00429d00
cmp byte [ebp - 0x4c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4105cc
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
cmp eax, ecx
je 0x4105cc
push eax
call fcn.0049c7b1
add esp, 4
xor al, al
jmp 0x4105d8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410b60
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e57fb
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
mov ebx, dword [ebp + 8]
jne 0x410ba2
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x410bc0
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x410c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x11c], 0
mov edi, eax
lea eax, [esi + 0xc]
jne 0x410be9
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x410c73
shr eax, 4
not al
and al, 1
je 0x410c73
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x410c10
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x134]
add eax, 4
push 0
push eax
call fcn.0040f6f0
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 0
push eax
push 0x5032e4
push edi
mov ecx, ebx
call fcn.00429880
mov ecx, eax
call fcn.00429d00
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x410c6f
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x410c6f
push eax
call fcn.0049c7b1
add esp, 4
xor al, al
jmp 0x410c75
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4111a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5886
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.00410050
test al, al
je 0x4111e3
mov al, 1
jmp 0x41138c
lea ecx, [ebp - 0x134]
call fcn.00403e10
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00406110
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00411bd0
test al, al
je 0x4112a7
cmp dword [ebp - 0x130], 2
jb 0x411291
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
test bl, bl
cmove eax, ecx
movzx edx, word [eax + 6]
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 8]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 0xa]
cmp edx, 0x3a
jne 0x411291
cmp word [ebp - 0x25c], 0x5c
jne 0x411291
test ax, ax
je 0x4112a7
push 0
push edi
lea ecx, [ebp - 0x134]
call fcn.004111a0
test al, al
je 0x411332
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4112b6
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x411336
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x4112d4
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x258]
add eax, 4
push 0
push eax
call fcn.0040f6f0
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
push eax
push 0x503370
mov ecx, edi
call fcn.00429910
mov ecx, eax
call fcn.00429d00
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x411332
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x411332
push eax
call fcn.0049c7b1
add esp, 4
xor bl, bl
jmp 0x411361
cmp byte [esi + 0x11c], 0
lea ecx, [esi + 0xc]
jne 0x411345
mov ecx, dword [esi + 8]
push 1
push ecx
add ecx, 4
mov edx, 1
call fcn.004377d0
add esp, 8
mov ecx, esi
call fcn.00413be0
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41138a
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
cmp ecx, eax
je 0x41138a
push ecx
call fcn.0049c7b1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 8
Function at 0x411550
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5921
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x134]
mov esi, dword [ebp + 0xc]
call fcn.00403e10
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00406110
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push eax
mov ecx, esi
call fcn.00411bd0
test al, al
je 0x4115f0
push ecx
push ebx
lea ecx, [ebp - 0x134]
call fcn.004111a0
test al, al
je 0x41170b
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4115ff
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41161d
mov eax, dword [esi + 8]
cmp byte [edi + 0x11c], 0
lea ecx, [edi + 0xc]
jne 0x41162c
mov ecx, dword [edi + 8]
push 0
add eax, 4
push eax
lea eax, [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41170f
mov ecx, ebx
call fcn.00429910
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41165a
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x37c]
add eax, 4
push 0
push eax
call fcn.0040f6f0
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x411681
mov eax, dword [edi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x258]
add eax, 4
push 0
push eax
call fcn.0040f6f0
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
push 0x5033c8
call fcn.0040f340
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4116df
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x4116df
push eax
call fcn.0049c7b1
add esp, 4
cmp byte [ebp - 0x260], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41170b
mov eax, dword [ebp - 0x374]
lea ecx, [ebp - 0x370]
cmp eax, ecx
je 0x41170b
push eax
call fcn.0049c7b1
add esp, 4
xor bl, bl
jmp 0x411758
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41171e
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea ecx, [esi + 0xc]
jne 0x41173c
mov ecx, dword [esi + 8]
push 1
push ecx
add ecx, 4
mov edx, 1
call fcn.004377d0
add esp, 8
mov ecx, esi
call fcn.00413be0
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x411781
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x411781
push eax
call fcn.0049c7b1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e604b
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0x10
lea ecx, [ebp - 0x934]
push 0
push edi
call fcn.0040f6f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x41679e
shr eax, 4
not al
and al, 1
jne 0x4168c7
lea ecx, [ebp - 0x934]
call fcn.00410050
test al, al
jne 0x4167b4
xor esi, esi
jmp 0x4168d0
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.0041ec50
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x536a88
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4168c7
nop word [eax + eax]
mov edx, 0x4fb6dc
mov ecx, 0x536ab4
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x416826
test ax, ax
je 0x416822
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x416826
add ecx, 4
add edx, 4
test ax, ax
jne 0x416800
xor eax, eax
jmp 0x41682b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4168ac
mov eax, 0x503c60
mov ecx, 0x536ab4
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x416866
test dx, dx
je 0x416862
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x416866
add ecx, 4
add eax, 4
test dx, dx
jne 0x416840
xor eax, eax
jmp 0x41686b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4168ac
push 0x536ab4
push edi
lea eax, [ebp - 0x810]
push 0x503f00
push eax
call fcn.0041ec50
add esp, 0x10
test byte [0x536a88], 0x10
je 0x41689f
lea ecx, [ebp - 0x810]
call fcn.00416720
jmp 0x4168ac
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call ebx
push 0x536a88
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4167f0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
push edi
call ebx
mov esi, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4168fc
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x4168fc
push eax
call fcn.0049c7b1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x4169e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e60a1
mov eax, dword fs:[0]
push eax
sub esp, 0xa58
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xa59], dl
mov esi, ecx
call fcn.00416920
test al, al
jne 0x416a26
xor eax, eax
jmp 0x416c2f
sub esp, 0x10
lea ecx, [ebp - 0x934]
xor ebx, ebx
push ebx
push esi
call fcn.0040f6f0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], bl
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416ae2
shr eax, 4
not al
and al, 1
je 0x416ae2
sub esp, 0x10
lea ecx, [ebp - 0xa58]
push ebx
push esi
call fcn.0040f6f0
mov byte [ebp - 0xa60], bl
mov dword [ebp - 0xa64], ebx
sub esp, 8
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa64]
lea ecx, [ebp - 0xa58]
push eax
call fcn.00410b60
lea ecx, [ebp - 0xa64]
call fcn.004287f0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
cmp byte [ebp - 0x93c], bl
jne 0x416c01
mov eax, dword [ebp - 0xa50]
lea ecx, [ebp - 0xa4c]
cmp eax, ecx
je 0x416c01
push eax
call fcn.0049c7b1
add esp, 4
jmp 0x416c01
lea ecx, [ebp - 0x934]
call fcn.00410050
test al, al
jne 0x416af8
xor ebx, ebx
jmp 0x416c01
push esi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.0041ec50
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x536268
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x416bef
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, 0x4fb6dc
mov ecx, 0x536294
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x416b66
test ax, ax
je 0x416b62
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x416b66
add ecx, 4
add edx, 4
test ax, ax
jne 0x416b40
xor eax, eax
jmp 0x416b6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x416bd6
mov ecx, 0x503c60
mov eax, 0x536294
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x416ba6
test dx, dx
je 0x416ba2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x416ba6
add eax, 4
add ecx, 4
test dx, dx
jne 0x416b80
xor eax, eax
jmp 0x416bab
sbb eax, eax
or eax, 1
test eax, eax
je 0x416bd6
push 0x536294
push esi
lea eax, [ebp - 0x810]
push 0x503f00
push eax
call fcn.0041ec50
add esp, 0x10
lea ecx, [ebp - 0x810]
mov dl, 1
call fcn.004169e0
push 0x536268
push edi
call ebx
test eax, eax
jne 0x416b30
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
cmp byte [ebp - 0xa59], 0
je 0x416c01
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x416c2d
mov ecx, dword [ebp - 0x92c]
lea eax, [ebp - 0x928]
cmp ecx, eax
je 0x416c2d
push ecx
call fcn.0049c7b1
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x4180d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x418110
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004af1b3
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x418191
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4fb6d8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x418191
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x41818f
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x41819e
push esi
call fcn.0049c7b1
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4186b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.00491400
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x418707
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004baaa8
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.004180d0
add esp, 0x10
test al, al
je 0x4186f5
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x4187a2
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x419ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e63eb
mov eax, dword fs:[0]
push eax
sub esp, 0x934
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x93c], edx
mov ebx, ecx
sub esp, 0x10
lea ecx, [ebp - 0x934]
push 0
push ebx
call fcn.0040f6f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419b4e
shr eax, 4
not al
and al, 1
jne 0x419c66
lea ecx, [ebp - 0x934]
call fcn.00410050
test al, al
je 0x419cd7
push ebx
push str._s.
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00415690
add esp, 0x10
lea eax, [ebp - 0x810]
push 0x536f30
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419c66
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov edx, 0x4fb6dc
mov ecx, 0x536f5c
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x419bd6
test ax, ax
je 0x419bd2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x419bd6
add ecx, 4
add edx, 4
test ax, ax
jne 0x419bb0
xor eax, eax
jmp 0x419bdb
sbb eax, eax
or eax, 1
test eax, eax
je 0x419c4f
mov eax, 0x503c60
mov ecx, 0x536f5c
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x419c16
test dx, dx
je 0x419c12
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x419c16
add ecx, 4
add eax, 4
test dx, dx
jne 0x419bf0
xor eax, eax
jmp 0x419c1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x419c4f
push 0x536f5c
push ebx
push 0x503f00
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.00415690
mov edx, dword [ebp - 0x93c]
lea ecx, [ebp - 0x810]
add esp, 0x14
call fcn.00419ad0
push 0x536f30
push esi
call edi
test eax, eax
jne 0x419ba0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x419cd7
mov edi, ebx
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x419c70
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 5]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048f227
push str.___
mov esi, eax
push 5
push esi
mov dword [ebp - 0x940], esi
call fcn.004ba9d2
push ebx
lea edx, [edi + 1]
push edx
lea eax, [esi + 8]
push eax
call fcn.004ba9d2
mov ecx, dword [ebp - 0x93c]
xor eax, eax
add esp, 0x1c
mov word [esi + edi*2 + 8], ax
lea eax, [ebp - 0x940]
push eax
call fcn.0041de40
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x419d03
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x419d03
push eax
call fcn.0049c7b1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x41d310
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x200
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0
mov esi, edx
xorps xmm0, xmm0
push 0
push eax
mov dword [ebp - 0x210], esi
mov ebx, ecx
movq qword [ebp - 0x218], xmm0
call fcn.00491400
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x208]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x41d389
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x218]
push eax
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
call edi
test eax, eax
jne 0x41d40c
nop word [eax + eax]
mov ecx, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
xor eax, eax
mov word [ebp - 6], ax
call fcn.0041d310
mov esi, eax
test esi, esi
jne 0x41d40c
lea eax, [ebp - 0x218]
mov dword [ebp - 0x20c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
call edi
test eax, eax
je 0x41d3c0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
jne 0x41d42c
push dword [ebp - 0x210]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret