joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d520
Capabilities:
Get common file path
Get disk size
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
mov bl, cl
call fcn.00429740
add esp, 0xc
lea eax, [ebp - 0x210]
test bl, bl
push eax
push esi
push esi
push 0x1c
pop eax
push 0x26
pop ecx
cmovne eax, ecx
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x40d5cc
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.SHGetFolderPath_failed
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011b7
lea eax, [ebp - 0x22c]
push eax
push eax
push 0x420
push str.lite_installer::HasEnoughDiskSpace
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402499
mov al, 1
jmp 0x40d691
push ebx
push ebx
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x40d622
push str.GetDiskFreeSpaceEx_failed
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011b7
lea eax, [ebp - 0x22c]
push eax
push eax
push 0x426
jmp 0x40d5ac
cmp dword [ebp - 0x234], ebx
ja 0x40d68d
cmp dword [ebp - 0x238], 0x19000000
jae 0x40d68d
xor eax, eax
mov dword [ebp - 0x21c], ebx
push str.There_is_not_enough_disk_space_to_install_browser
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x218], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 0x214], bl
call fcn.004011b7
lea eax, [ebp - 0x22c]
push eax
push eax
push 0x42c
push str.lite_installer::HasEnoughDiskSpace
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [ebp - 0x22c]
call fcn.00402499
jmp 0x40d68f
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x40f0e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsd xmm0, qword [0x456c28]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
push str.yandex.lite.set_import_progress
mov dword [ebx + 4], ecx
lea edi, [ebx + 0xc]
mov dword [ebx + 8], ecx
mov dword [edi], 0x4570f0
mov dword [ebx + 0x10], eax
mov dword [ebx], 0x457200
mov dword [edi], 0x4571c4
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x2c], ecx
mov dword [ebx + 0x30], ecx
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x38], 0x45736c
mov byte [ebx + 0x48], 1
mov byte [ebx + 0x50], cl
mov dword [ebx + 0x68], ecx
mov dword [ebx + 0x6c], ecx
movsd qword [ebx + 0x70], xmm0
mov byte [ebx + 0x78], 1
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x84], ecx
movsd qword [ebx + 0x88], xmm0
mov byte [ebx + 0x90], 1
mov dword [ebx + 0x98], ecx
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0xa4], ecx
movsd qword [ebx + 0xa8], xmm0
mov byte [ebx + 0xb0], 1
mov dword [ebx + 0xb8], ecx
mov dword [ebx + 0xbc], ecx
movsd qword [ebx + 0xc0], xmm0
mov byte [ebx + 0xc8], 1
mov dword [ebx + 0xd0], ecx
mov dword [ebx + 0xd4], ecx
mov dword [ebx + 0xd8], ecx
mov dword [ebx + 0xdc], ecx
mov dword [ebx + 0xe0], ecx
mov dword [ebx + 0xe4], ecx
mov dword [ebx + 0xe8], ecx
mov dword [ebx + 0xec], ecx
mov dword [ebx + 0xf0], ecx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.lite.close_window
mov dword [ebx + 0xf4], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.lite.set_install_progress
mov dword [ebx + 0xf8], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.yandex.higher_version_exist
mov dword [ebx + 0xfc], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
movsd xmm0, qword [0x456c28]
lea esi, [ebx + 0x138]
mov dword [ebx + 0x100], eax
mov ecx, esi
xor eax, eax
mov dword [ebx + 0x104], eax
mov word [ebx + 0x108], ax
mov dword [ebx + 0x10c], eax
mov byte [ebx + 0x110], al
mov dword [ebx + 0x118], eax
mov dword [ebx + 0x11c], eax
movsd qword [ebx + 0x120], xmm0
mov byte [ebx + 0x128], 1
mov eax, dword [ebx + 0x10]
push dword [eax + 0x64]
call fcn.00412626
push 0x138
mov dword [esi], 0x457300
mov dword [esi + 0x28], 1
call fcn.0042769c
pop ecx
push dword [ebx + 0x14]
mov ecx, eax
push dword [ebx + 0x10]
push edi
call fcn.0040701d
mov esi, dword [ebx + 0x98]
mov dword [ebx + 0x98], eax
test esi, esi
je 0x40f2c1
mov ecx, esi
call fcn.0040749a
push esi
call fcn.0042740d
pop ecx
mov esi, dword [ebx + 0x98]
push dword [esi + 0x88]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esi + 0x8c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
push eax
push eax
push esi
push 0x407810
push eax
push eax
call fcn.0043044e
add esp, 0x18
mov dword [esi + 0x84], eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x411113
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x456cc0]
lea edx, [ebp - 4]
push ebx
push esi
mov eax, ecx
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov esi, ecx
mov dword [ebp - 0x2c], ecx
cmp edx, esi
mov dword [ebp - 0x30], ebx
movups xmmword [ebp - 0x24], xmm0
sbb esi, esi
movaps xmm0, xmmword [0x456cb0]
and esi, 0xfffffff8
add esi, 8
push edi
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x34], esi
mov ecx, dword [ecx]
push ecx
push dword [eax + 4]
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4111a4
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x3c]
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x411180
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add ecx, 4
inc ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
cmp ebx, esi
jne 0x41115e
mov ebx, dword [ebp - 0x28]
lea edi, [ebp - 0x14]
mov esi, 0x4539b8
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebx + 0xd8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00413178
mov eax, dword [ebp - 0x14]
mov edx, 0x3f1
add eax, dword [ebp - 0x38]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004151e1
pop ecx
push 5
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x640000
xor esi, esi
push esi
push 0x401
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
push 0x402
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x10]
mov edx, 0x42a
mov ecx, 0x130
cmp dword [eax + 0x64], 0x419
cmove ecx, edx
push ecx
lea ecx, [ebx + 0xb8]
call fcn.00414f2e
push esi
push 0x14
push 0x64
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x4114c7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
mov word [ebp - 0x1c], ax
mov esi, ecx
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0xc], edi
push 7
pop ebx
mov dword [ebp - 8], ebx
sub eax, 0x3fd
je 0x41150f
sub eax, 0x21
je 0x411502
sub eax, 0xe
jne 0x411547
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x34]
call fcn.0040d434
jmp 0x41151a
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x34]
call fcn.0040eb39
push eax
lea ecx, [ebp - 0x1c]
call fcn.00405ab4
lea ecx, [ebp - 0x34]
call fcn.00402499
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 5
cmovae eax, dword [ebp - 0x1c]
push edi
push edi
push eax
push 0x45397c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [esi + 0x98]
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], edi
push str.clicked_link
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x34], ax
call fcn.004067a8
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004097c1
lea ecx, [ebp - 0x34]
call fcn.00402499
lea ecx, [ebp - 0x1c]
call fcn.00402499
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret 0x10

Function at 0x411661
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x130]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41168d
push 0
push dword [esi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x411d6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0x7d0
mov edi, ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push dword [ebp + 0x20]
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.004043eb
lea eax, [ebp + 8]
mov byte [edi + 0x54], 1
push eax
lea ecx, [edi + 0x18]
call fcn.00412030
push ebx
push ebx
push edi
push 0x411df0
push ebx
push ebx
call fcn.0043044e
mov ecx, dword [ebp + 0xc]
add esp, 0x18
test ecx, ecx
je 0x411ddb
call fcn.00414b12
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x411e48
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x18
pop ecx
mov eax, dword [edi + 0x1c]
sub eax, dword [edi + 0x18]
cdq
idiv ecx
lea edx, [edi + 0x3c]
inc eax
lea ecx, [ebp - 0x58]
push eax
call fcn.00411ccc
pop ecx
xor ebx, ebx
mov dword [ebp - 0x40], 0x457164
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], bl
call fcn.0040cdb6
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040ce70
test al, al
jne 0x411ecd
lea ecx, [ebp - 0xcc]
call fcn.0040ce32
jmp 0x411ffd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [ebp - 0xcc]
call fcn.0040d0ae
test eax, eax
je 0x411ef8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1388
ja 0x411ebd
cmp byte [edi + 0x54], bl
jne 0x411ed5
cmp byte [edi + 0x54], bl
je 0x411f10
lea ecx, [ebp - 0xcc]
call fcn.0040d24d
mov byte [ebp - 0xcd], al
jmp 0x411f16
mov byte [ebp - 0xcd], bl
lea ecx, [ebp - 0xcc]
call fcn.0040ce32
cmp byte [ebp - 0xcd], bl
je 0x411ffd
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], ebx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0xf
mov byte [ebp - 0x20], bl
call fcn.00403359
lea ecx, [ebp - 0x40]
call fcn.0040cda0
cmp dword [ebp - 0xc], 0x10
lea eax, [ebp - 0x20]
push dword [ebp - 0x10]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateMemStream]
movsd xmm0, qword [0x456c28]
lea ecx, [ebp - 0xec]
mov esi, eax
mov dword [ebp - 0xec], ebx
push esi
movaps xmm2, xmm0
mov dword [ebp - 0xe8], ebx
movsd qword [ebp - 0xe4], xmm0
mov byte [ebp - 0xdc], 1
call fcn.00415028
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xec]
call fcn.00414ec0
movd xmm0, dword [eax]
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [ebp - 0xe4]
cvttsd2si eax, xmm0
test eax, eax
je 0x411fe6
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0xec]
push eax
lea ecx, [edi + 0x18]
call fcn.00412030
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xe8]
test ecx, ecx
je 0x411ff5
call fcn.00414b12
lea ecx, [ebp - 0x20]
call fcn.00402525
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x40], 0x457164
call fcn.00402525
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x40], 0x457158
call fcn.00402499
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret 4
Function at 0x414cca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xa
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x414d56
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414d2f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x414d2f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x414d33
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x414d55
push edi
push ebx
push eax
call fcn.004291c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4164d5
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.0041656f
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x416565
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x41655e
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x416555
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x416555
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x416567
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.0041656f
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4165ad
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
je 0x41661c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41661c
mov edx, dword [eax + 0x3c]
cmp dword [edx + eax], 0x4550
jne 0x41661c
mov edx, dword [edx + eax + 0x98]
add eax, edx
neg edx
sbb edx, edx
and edx, eax
je 0x41661c
lea eax, [edx + 8]
test eax, eax
je 0x41661c
cmp byte [eax], 0x30
push esi
jne 0x41660b
cmp byte [eax + 1], 0x82
jne 0x41660b
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
add eax, 0x13
add eax, ecx
and eax, 0xffffff8
jmp 0x41660d
xor eax, eax
pop esi
test eax, eax
je 0x41661c
mov dword [edi + 0x14], eax
mov al, 1
mov dword [edi + 0x18], edx
jmp 0x41661e
xor al, al
pop edi
pop ebp
ret 4
Function at 0x4166b0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
push esi
push 3
push ecx
push ecx
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], esi
call fcn.0041c5a0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041c810
cmp dword [ebp - 0x10], 0
je 0x416810
cmp byte [ebp - 0x2e4], 0
jne 0x416718
push 0x250
lea eax, [ebp - 0x53c]
push 0
push eax
call fcn.00429740
add esp, 0xc
jmp 0x416731
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x53c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2e8]
mov ebx, dword [ebp - 0x53c]
test bl, 1
je 0x416754
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
shr ebx, 4
test bl, 1
je 0x416787
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.004166b0
add esp, 4
test al, al
je 0x416877
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x416799
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x416877
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041c810
push eax
lea ecx, [ebp - 0x20]
call fcn.00417cb0
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x416806
mov ecx, dword [ebp - 0x38]
inc eax
cmp eax, 0x7fffffff
ja 0x4168ba
add eax, eax
cmp eax, 0x1000
jb 0x4167fd
test cl, 0x1f
jne 0x4168ba
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4168ba
sub ecx, eax
sub ecx, 4
cmp ecx, 0x1f
ja 0x4168ba
mov ecx, eax
push ecx
call fcn.0042740d
add esp, 4
cmp dword [ebp - 0x10], 0
jne 0x4166f7
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x416857
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x4168ba
add eax, eax
cmp eax, 0x1000
jb 0x41684e
test cl, 0x1f
jne 0x4168ba
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4168ba
sub ecx, eax
cmp ecx, 4
jb 0x4168ba
cmp ecx, 0x23
ja 0x4168ba
mov ecx, eax
push ecx
call fcn.0042740d
add esp, 4
mov bl, 1
lea ecx, [ebp - 0x2e4]
call fcn.0041c760
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x4168b6
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x4168ba
add eax, eax
cmp eax, 0x1000
jb 0x4168ad
test cl, 0x1f
jne 0x4168ba
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4168ba
sub ecx, eax
cmp ecx, 4
jb 0x4168ba
cmp ecx, 0x23
ja 0x4168ba
mov ecx, eax
push ecx
call fcn.0042740d
add esp, 4
xor bl, bl
jmp 0x416859
call fcn.0042c6c3
int3
Function at 0x4168c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x4168ef
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427412
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x416a7f
lea eax, [ebp - 0x1c]
push eax
call fcn.00418d10
push ecx
push 0x454340
mov ecx, eax
call fcn.004176a0
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00417ae0
cmp esi, 0xffffffff
je 0x41696e
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.00418d10
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004183f0
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.004166b0
add esp, 4
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00417ae0
lea ecx, [ebp - 0x34]
call fcn.00417ae0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427412
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x416978
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4168dc
test bl, 1
je 0x4169ae
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x416999
mov ecx, dword [edi]
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x416a7f
test bl, 0x10
jne 0x4169d8
cmp dword [edi + 0x14], 8
jb 0x4169bb
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427412
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 8], 7
push 2
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push 0x454348
push eax
mov dword [ebp - 0xc], 1
call fcn.004283e0
add esp, 8
lea edx, [ebp - 0x1c]
xor eax, eax
mov ecx, edi
mov word [ebp - 0x1a], ax
call fcn.004166b0
add esp, 4
test al, al
mov eax, dword [ebp - 8]
setne bl
cmp eax, 8
jb 0x416a56
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x416a92
add eax, eax
cmp eax, 0x1000
jb 0x416a4d
test cl, 0x1f
jne 0x416a92
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x416a92
sub ecx, eax
cmp ecx, 4
jb 0x416a92
cmp ecx, 0x23
ja 0x416a92
mov ecx, eax
push ecx
call fcn.0042740d
add esp, 4
test bl, bl
je 0x416a7f
cmp dword [edi + 0x14], 8
jb 0x416a62
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427412
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427412
mov esp, ebp
pop ebp
ret
call fcn.0042c6c3
int3

Function at 0x416ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x416ad8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x416af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x45a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x218]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x416bb7
lea eax, [ebp - 0x218]
sub esp, 8
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416b37
sub ecx, esi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.00417a30
sub esp, 8
mov ecx, eax
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x416b63
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [ebp - 0x230]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00417a30
lea ecx, [ebp - 0x230]
call fcn.004191e0
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00417cb0
lea ecx, [ebp - 0x230]
call fcn.00417ae0
lea ecx, [ebp - 0x248]
call fcn.00417ae0
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427412
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00427412
mov esp, ebp
pop ebp
ret
Function at 0x4175e0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00419010
test al, al
jne 0x41764c
mov ecx, esi
call fcn.00419010
test al, al
jne 0x41764c
cmp dword [edi + 0x10], 0x104
jae 0x41764c
cmp dword [esi + 0x10], 0x104
jae 0x41764c
cmp dword [esi + 0x14], 8
jb 0x417615
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41761d
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41764c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41764c
test al, 1
je 0x417646
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret