joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c87c
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x5cdefc
call fcn.0058f9ee
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.0056acf8
push 0x15c
call fcn.00495997
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x55c8c0
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.0057692d
jmp 0x55c8c2
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0056acca
call fcn.004988c7
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x55ca62
cmp dword [edi + 4], ebx
jle 0x55ca62
lea ecx, [ebp - 0x21c]
call fcn.0040144d
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x55ca46
lea ecx, [ebp - 0x220]
call fcn.0040144d
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x55c997
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.00401518
add esp, 0xc
jmp 0x55c9c9
jge 0x55c9b7
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__s
push eax
call fcn.00401518
add esp, 0x10
jmp 0x55c9c9
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040227d
push 0x15c
call fcn.00495997
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x55c9ed
mov ecx, eax
call fcn.00505fd7
mov esi, eax
jmp 0x55c9ef
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.004a48b8
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.0056acca
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00401019
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401019
inc ebx
cmp ebx, dword [edi + 4]
jl 0x55c930
call fcn.0058fa71
ret
Function at 0x55f005
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x5ce265
call fcn.0058f9ee
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.0040144d
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x13
jne 0x55f033
push 0x613e24
jmp 0x55f076
push 0x66
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.0058fa90
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x55f065
or eax, 0x1000000
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00401287
lea ecx, [ebp - 0x7c]
call fcn.00405e8f
mov esi, dword [ebp - 0x7c]
cmp dword [esi - 0xc], edi
jle 0x55f0c7
push edi
lea ecx, [ebp - 0x7c]
call fcn.00401d68
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x55f0ad
inc edi
cmp edi, dword [esi - 0xc]
jl 0x55f08e
jmp 0x55f0c7
movzx eax, bx
push eax
call fcn.005977ca
pop ecx
movzx eax, ax
push eax
push edi
lea ecx, [ebp - 0x7c]
call fcn.0041affc
mov esi, dword [ebp - 0x7c]
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x80]
push esi
call fcn.0040202a
cmp dword [ebp + 0x10], 0
jne 0x55f0e3
mov ecx, dword [ebp - 0x80]
push 0x2b
call fcn.0041b4b2
lea ecx, [esi - 0x10]
call fcn.00401019
call fcn.0058fa71
ret 0xc
Function at 0x56c84c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x56c896
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x56c896
call fcn.0056c105
test eax, eax
je 0x56c896
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.00414deb
xor eax, eax
inc eax
jmp 0x56caae
cmp dword [ebx + 4], 0x100
push edi
jne 0x56caa5
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x56c993
push 0x11
call edi
test ax, ax
jl 0x56c993
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x56c993
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x56c906
cmp eax, 0x20
jbe 0x56c993
cmp eax, 0x24
jbe 0x56c8f9
cmp eax, 0x26
je 0x56c8f9
cmp eax, 0x28
jne 0x56c993
call fcn.0056c105
test eax, eax
je 0x56c993
mov ecx, esi
call fcn.004a10db
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.0056c105
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x56c93b
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00414deb
jmp 0x56caa0
call fcn.0049e489
test eax, eax
je 0x56caa0
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.0049e4c1
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x56c969
xor edi, edi
jmp 0x56c96c
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0049e489
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x56caa0
mov eax, dword [ebx + 8]
sub eax, 9
je 0x56ca6f
sub eax, 0x12
je 0x56ca47
sub eax, 0xb
je 0x56c9b5
dec eax
dec eax
jne 0x56caa5
push 0x12
call edi
test ax, ax
jl 0x56caa5
push 0x11
call edi
test ax, ax
jl 0x56caa5
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x56caa5
call fcn.0056c105
test eax, eax
jne 0x56caa0
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.0056c07f
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0049ce17
test eax, eax
je 0x56caa0
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.0049ce17
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x56caa0
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x56ca5b
push 0
call fcn.0056c07f
mov ecx, esi
call fcn.0049df57
test eax, eax
je 0x56caa5
mov ecx, esi
call fcn.0049df57
jmp 0x56ca99
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.0049ce17
test eax, eax
je 0x56caa5
push dword [esi + 0x20]
call edi
push eax
call fcn.0049ce17
push 0
push esi
mov ecx, eax
call fcn.004a203c
mov ecx, eax
call fcn.004a10db
xor eax, eax
inc eax
jmp 0x56caad
push ebx
mov ecx, esi
call fcn.0049ab8f
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x572b2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0049e86b
call fcn.0049b69d
cmp eax, esi
pop esi
jne 0x572b46
mov ecx, 0x66a1e8
jmp fcn.004be95a
ret

Function at 0x589edb
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x589f20
test edi, edi
jl 0x589f20
cmp ax, 0x20
je 0x589f15
cmp word [ebp + 8], 0x71
jne 0x589f20
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x58f976
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x664e94]
jne 0x58f980
repz ret
jmp fcn.0059c43c

Function at 0x596de6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x596e17
call fcn.005973ce
mov dword [eax], esi
call fcn.005973bb
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005911c8
add esp, 0x14
push 0x16
pop eax
jmp 0x596e6c
test dword [ebp + 0xc], 0xfffffff9
jne 0x596df3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x596e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005973e1
pop ecx
call fcn.005973bb
mov eax, dword [eax]
jmp 0x596e6c
test al, 0x10
jne 0x596e6a
test al, 1
je 0x596e6a
test byte [ebp + 0xc], 2
je 0x596e6a
call fcn.005973ce
mov dword [eax], 5
call fcn.005973bb
mov dword [eax], 0xd
jmp 0x596e3b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5aa898
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005994ba
and dword [ebp - 4], 0
cmp dword [0x66dea0], 0
mov ebx, eax
jne 0x5aa949
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5aa9fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5aa9fa
push eax
call fcn.00599448
mov dword [esp], 0x6254d0
push edi
mov dword [0x66dea0], eax
call esi
push eax
call fcn.00599448
mov dword [esp], 0x6254bc
push edi
mov dword [0x66dea4], eax
call esi
push eax
call fcn.00599448
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x66dea8], eax
call esi
push eax
call fcn.00599448
pop ecx
mov dword [0x66deb0], eax
test eax, eax
je 0x5aa949
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00599448
pop ecx
mov dword [0x66deac], eax
mov eax, dword [0x66deac]
cmp eax, ebx
je 0x5aa9a1
cmp dword [0x66deb0], ebx
je 0x5aa9a1
push eax
call fcn.005994c3
push dword [0x66deb0]
mov esi, eax
call fcn.005994c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5aa9a1
test edi, edi
je 0x5aa9a1
call esi
test eax, eax
je 0x5aa998
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5aa998
test byte [ebp - 0xc], 1
jne 0x5aa9a1
or dword [ebp + 0x10], 0x200000
jmp 0x5aa9da
mov eax, dword [0x66dea4]
cmp eax, ebx
je 0x5aa9da
push eax
call fcn.005994c3
pop ecx
test eax, eax
je 0x5aa9da
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5aa9da
mov eax, dword [0x66dea8]
cmp eax, ebx
je 0x5aa9da
push eax
call fcn.005994c3
pop ecx
test eax, eax
je 0x5aa9da
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x66dea0]
call fcn.005994c3
pop ecx
test eax, eax
je 0x5aa9fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5aa9fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1446
mov eax, dword fs:[0]
push eax
sub esp, 0x194
push ebx
push esi
push edi
mov eax, dword [0x4d6390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4abab8
push 1
mov bl, 1
push 0
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x407e6e
call fcn.00433d90
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x407f3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x54
push str.d:jenkins.jenkinsworkspacepay_groupdll_repairdll_repairdll_repair_srcmain.cc
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], esi
mov ebx, eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040a100
push 3
push 0x4abab4
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0040a100
mov byte [ebp - 4], 1
call fcn.00433d90
mov edi, eax
lea ecx, [ebp - 0x108]
push 0x13
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00405130
mov esi, eax
push str.check_instance_fail__errno_
push esi
mov byte [ebp - 4], 2
call fcn.004060d0
add esp, 8
mov ecx, esi
push ebx
call fcn.00405f30
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x108]
call fcn.00406330
lea ecx, [ebp - 0x28]
call fcn.00405aa0
lea ecx, [ebp - 0x40]
call fcn.00405aa0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407f51
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00433d90
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x407f3d
push 0x54
push str.d:jenkins.jenkinsworkspacepay_groupdll_repairdll_repairdll_repair_srcmain.cc
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], al
call fcn.0040a100
push 3
push 0x4abab4
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 3
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.0040a100
mov byte [ebp - 4], 4
call fcn.00433d90
mov edi, eax
lea ecx, [ebp - 0x1a0]
push 0x18
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00405130
mov esi, eax
push str.instance_exist
push esi
mov byte [ebp - 4], 5
call fcn.004060d0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x1a0]
call fcn.00406330
lea ecx, [ebp - 0x58]
call fcn.00405aa0
lea ecx, [ebp - 0x70]
call fcn.00405aa0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x407f5a
mov dword [eax], esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4d6390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4083c7
test ebx, ebx
je 0x4083c7
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4083c7
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x4083c7
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4083c1
push esi
push ebx
push edi
call fcn.00478c90
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4083c1
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004582e2
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004582e2
mov esp, ebp
pop ebp
ret

Function at 0x4083e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408439
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408439
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40842a
cmp esi, edx
jae 0x408439
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408418
cmp esi, edx
jae 0x408439
cmp word [esi], 0
je 0x408439
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40b0c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1668
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x4d6390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00457fee
mov edi, eax
add esp, 4
test edi, edi
je 0x40b163
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042e2ae
add esp, 4
mov dword [edi + 4], eax
jmp 0x40b165
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00404a30
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40b1c5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40b1c5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40b1e9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40b20b
cmp byte [ebp + 0xc], 0
je 0x40b1f8
push esi
call fcn.0042e7d5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40b217
mov esi, str.ios_base::badbit_set
jmp 0x40b227
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040b250
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.004056d0
push 0x4ca928
lea eax, [ebp - 0x30]
push eax
call fcn.0047886e
int3
Function at 0x41b930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a31e0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4d6390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov bl, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
test bl, bl
jne 0x41b979
cmp byte [esi + 0xf0], bl
jne 0x41b979
mov al, 1
jmp 0x41ba9f
movzx edi, bl
xor edi, 1
add edi, ecx
cmp byte [edi + 0x18], 0
jne 0x41ba9c
mov eax, dword [esi + 0x1c]
mov edx, str.__x64_
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x41b9dc
test bl, bl
mov eax, str.__x86_
cmove eax, edx
push eax
push ecx
lea eax, [ebp - 0x48]
push eax
call fcn.00418870
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x48]
push 0
push 4
push eax
mov edx, dword [ecx]
lea eax, [esi + 4]
push eax
mov dword [ebp - 4], 0
call dword [edx + 0xc]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.00405af0
test bl, bl
je 0x41b9ee
cmp byte [esi + 0xf0], 0
mov eax, 0xd8
jne 0x41b9f3
mov eax, 0xc0
add eax, esi
push 0x4ab60c
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00418870
push dword [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00418810
add esp, 0x18
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.00405af0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
mov byte [edi + 0x18], al
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x41ba94
test bl, bl
mov ecx, str.__x64_
mov eax, str.__x86_
cmove eax, ecx
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x60]
push eax
call fcn.00418870
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp byte [edi + 0x18], al
push 0
setne al
mov byte [ebp - 4], 4
mov edx, dword [ecx]
add eax, 5
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [esi + 4]
push eax
call dword [edx + 0xc]
lea ecx, [ebp - 0x60]
call fcn.00405af0
lea ecx, [ebp - 0x28]
call fcn.00405af0
mov al, byte [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004582e2
mov esp, ebp
pop ebp
ret 8
Function at 0x424180
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a41b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4d6390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x3c
call fcn.00457fee
mov ecx, dword [ebp + 8]
mov esi, eax
lea edx, [esi + 4]
mov dword [ebp - 0x14], esi
add esp, 4
mov dword [ebp - 4], 0
lea edi, [edx + 4]
mov dword [ebp - 0x18], edx
mov dword [esi], vtable.std::_Func_impl_no_alloc_class__lambda_cda2627f00237dd55970028a13a9395e___void___.0
lea ebx, [ecx + 4]
mov eax, dword [ecx]
mov ecx, edi
push ebx
mov dword [edx], eax
mov dword [ebp + 8], edi
call fcn.00404f30
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x18]
push eax
mov dword [ebp - 0x18], ecx
call fcn.00404f30
mov eax, dword [ebx + 0x30]
mov dword [edi + 0x30], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4290e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3e78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4d6390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x10], esi
call fcn.0042c090
add esp, 4
push 0xb
push str.dll_repair
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00409f70
push eax
mov ecx, esi
call fcn.0040d460
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42916b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429161
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x429192
push edx
push ecx
call fcn.0045801e
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x429175
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0047cbf9
int3