joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
mov esi, ecx
test ebx, ebx
je 0x40fc76
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x40fc71
mov eax, dword [ebx]
jmp 0x40fc73
mov eax, ebx
mov byte [eax], 0
call fcn.004179e0
test al, al
je 0x40fc87
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.00415200
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x40fca1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10000
call fcn.004ff84f
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.0050dd47
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40fd16
mov eax, dword [ebp + 8]
nop
test ebx, ebx
je 0x40fcec
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00408510
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x40fd2c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.0050dd47
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x40fcd0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0050cd90
add esp, 4
test eax, eax
jne 0x40fd2f
mov byte [ebp - 1], 1
jmp 0x40fd33
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.0050d018
add esp, 4
test esi, esi
je 0x40fd49
push esi
call fcn.004ff84a
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x410ddd
cmp byte [ebx + 0x3d], 0
je 0x410ddd
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x410ccd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x14]
call fcn.00407d50
push 0
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00410a90
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
lea eax, [esp + 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x18]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x410d5c
sub eax, 1
je 0x410d60
sub eax, 2
je 0x410dbe
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.004079d0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp ecx, 0x10
mov esi, dword [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x410d9f
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0050d5dc
add esp, 0x10
cmp esi, eax
jne 0x410d3d
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
cmp byte [ebx + 0x3d], 0
je 0x410dbe
test esi, esi
jne 0x410d00
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00410b60
jmp 0x410cf8
lea ecx, [esp + 0x14]
mov bl, 1
call fcn.004079d0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x4144a0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.0041fa10
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041fb30
cmp dword [ebp - 0x10], ebx
je 0x414602
nop
cmp byte [ebp - 0x2e4], 0
jne 0x41452a
test bl, 1
je 0x414512
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.0041d2d0
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.00505ae0
add esp, 0xc
jmp 0x414543
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
mov cl, byte [ebp + 8]
test bl, 1
je 0x414579
test cl, cl
jne 0x41455e
mov eax, ebx
shr eax, 4
test al, 1
jne 0x414579
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, byte [ebp + 8]
shr ebx, 4
test bl, 1
je 0x4145b0
test cl, cl
je 0x4145ca
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.004144a0
add esp, 4
test al, al
je 0x41465e
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4145c2
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41465e
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0041fb30
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x4145ea
push 0xffffffffffffffff
push 0
push eax
call fcn.00407f70
lea ecx, [ebp - 0x38]
call fcn.004077f0
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x2e8]
jne 0x4144f0
lea ecx, [ebp - 0x20]
call fcn.004077f0
mov bl, 1
mov eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x41461e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x54]
call fcn.0041ff40
push dword [ebp - 0x54]
call fcn.004ff607
add esp, 4
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x6c]
call fcn.004077f0
lea ecx, [ebp - 0x8c]
call fcn.004077f0
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.004077f0
xor bl, bl
jmp 0x41460c
Function at 0x414710
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], 0
mov ebx, edx
mov dword [esp + 0x14], ebx
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x414752
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x4148be
lea eax, [esp + 0x1c]
push eax
call fcn.00417270
push 2
push 0
push 0x5a8864
mov ecx, eax
call fcn.00415890
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.004077f0
cmp esi, 0xffffffff
je 0x4147d6
lea eax, [esp + 0x34]
mov ecx, edi
push eax
call fcn.00417270
mov esi, eax
mov ecx, edi
push ebx
lea eax, [esp + 0x20]
push eax
call fcn.00417130
mov edx, esi
mov ecx, eax
call fcn.004144a0
add esp, 4
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.004077f0
lea ecx, [esp + 0x34]
call fcn.004077f0
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x4147e0
mov eax, dword [edi]
jmp 0x4147e2
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41473e
test bl, 1
je 0x41481a
cmp dword [edi + 0x14], 8
jb 0x414803
mov ecx, dword [edi]
jmp 0x414805
mov ecx, edi
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4148be
test bl, 0x10
jne 0x414846
cmp dword [edi + 0x14], 8
jb 0x414827
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x14], 0
je 0x414879
push 0x5a886c
lea ecx, [esp + 0x20]
call fcn.00407830
mov ebx, 1
lea edx, [esp + 0x1c]
push ebx
mov ecx, edi
call fcn.004144a0
add esp, 4
test al, al
jne 0x41487d
mov byte [esp + 0x13], al
jmp 0x414882
mov ebx, dword [esp + 0x18]
mov byte [esp + 0x13], 1
test bl, 1
je 0x414890
lea ecx, [esp + 0x1c]
call fcn.004077f0
cmp byte [esp + 0x13], 0
je 0x4148be
cmp dword [edi + 0x14], 8
jb 0x41489f
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x4c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x414c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x414c5e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x414c70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x414c78
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x414c8b
shr eax, 4
and eax, 1
ret
xor al, al
ret

Function at 0x414c90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x34]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x414d72
sub esp, 8
lea eax, [esp + 0x40]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x40], 0
jne 0x414ce2
xor ecx, ecx
jmp 0x414cff
lea ecx, [esp + 0x40]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414cf0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [esp + 0x28]
call fcn.00416b30
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x414d1a
mov ecx, dword [eax]
jmp 0x414d1c
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x10]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00416b30
lea ecx, [esp + 8]
call fcn.00417a90
lea eax, [esp + 8]
cmp esi, eax
je 0x414d4a
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407f70
lea ecx, [esp + 8]
call fcn.004077f0
lea ecx, [esp + 0x20]
call fcn.004077f0
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x414d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x1c]
push edi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x414e3f
cmp word [esp + 0x20], 0
je 0x414e3f
sub esp, 8
lea eax, [esp + 0x28]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x28], 0
jne 0x414e03
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00416b30
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e10
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.00416b30
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
call fcn.00407890
lea eax, [esp + 8]
push eax
call fcn.00414c90
add esp, 4
mov ecx, esi
test al, al
je 0x414e67
lea eax, [esp + 8]
push eax
call fcn.004078b0
jmp 0x414e7e
sub esp, 8
mov eax, esp
mov dword [eax], 0x5a8870
mov dword [eax + 4], 3
call fcn.00416b30
lea ecx, [esp + 8]
call fcn.004077f0
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
Function at 0x414ea0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5bf23c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x54], ecx
mov ebx, edx
push edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x58], eax
call fcn.00407890
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
nop
lea ecx, [ebp - 0x20]
call fcn.00407890
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x20]
call fcn.00407f70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.0041e4e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c30
lea ecx, [ebp - 0x50]
call fcn.004077f0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, edx
jne 0x414f50
lea ecx, [eax + 1]
cmp ecx, 0x7ffffffe
ja 0x415053
cmp edx, ecx
jae 0x414f36
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.00408eb0
jmp 0x414f4a
test ecx, ecx
jne 0x414f50
cmp edx, 8
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp edx, 8
lea ecx, [ebp - 0x20]
mov edx, 0x5f
cmovae ecx, dword [ebp - 0x20]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
inc eax
xor edx, edx
mov dword [ebp - 0x10], eax
mov word [ecx + eax*2], dx
lea ecx, [ebp - 0x64]
call fcn.0042a640
cmp dword [ebp - 0x60], 0xffffffff
ja 0x414f70
mov edx, dword [ebp - 0x64]
jb 0x414f8b
cmp edx, 0xffff7fff
ja 0x414f70
and edx, 0x7fff
lea ecx, [ebp - 0x50]
call fcn.0041e4e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c30
lea ecx, [ebp - 0x50]
call fcn.004077f0
sub esp, 8
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xc], 8
mov ecx, esp
cmovae eax, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
push eax
call fcn.004176e0
lea ecx, [ebp - 0x38]
cmp ecx, eax
je 0x414fe6
push 0xffffffffffffffff
push 0
push eax
call fcn.00407f70
lea ecx, [ebp - 0x50]
call fcn.004077f0
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0
cmovae eax, dword [ebp - 0x38]
push eax
call edi
test eax, eax
jne 0x415018
lea ecx, [ebp - 0x20]
call fcn.004077f0
inc esi
cmp esi, 0x32
jl 0x414ed0
xor bl, bl
jmp 0x415038
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x38]
cmp eax, ecx
je 0x41502e
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00407f70
lea ecx, [ebp - 0x20]
call fcn.004077f0
mov bl, 1
lea ecx, [ebp - 0x38]
call fcn.004077f0
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00500f0a
int3
Function at 0x4150d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x4150fd
mov ebx, dword [edi]
jmp 0x4150ff
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415141
test al, 0x10
je 0x415123
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x41512d
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.00417130
cmp dword [edi + 0x14], 8
jb 0x415157
mov ecx, dword [edi]
jmp 0x415159
mov ecx, edi
push dword [edi + 0x10]
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
push ecx
cmovae eax, dword [esp + 0x1c]
push dword [esp + 0x2c]
push eax
call fcn.00415830
add esp, 0x10
test eax, eax
jne 0x41518a
test esi, esi
je 0x4151ce
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x4151d4
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.004150d0
test al, al
je 0x4151ce
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4151d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x4151c1
mov ecx, edi
call fcn.00414c70
test al, al
jne 0x4151d2
test esi, esi
je 0x4151ce
mov ecx, ebx
call fcn.0041f6f0
mov dword [esi], eax
xor bl, bl
jmp 0x4151d4
mov bl, 1
lea ecx, [esp + 0x14]
call fcn.004077f0
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret

Function at 0x4152a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov dword [esp + 8], 0
mov esi, edx
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 8]
jb 0x4152c0
mov ecx, dword [ecx]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.00412120
mov eax, dword [esp + 8]
test eax, eax
je 0x415311
cmp eax, 0xffffffff
je 0x415311
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x415311
mov esi, dword [esp + 0xc]
cmp esi, edi
je 0x415314
or esi, 0xffffffff
lea ecx, [esp + 8]
call fcn.004120b0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x258], eax
xor eax, eax
push esi
mov word [esp + 0x50], ax
mov esi, ecx
lea eax, [esp + 0x50]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x415419
cmp eax, 0x104
ja 0x415419
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0xc]
call fcn.00407830
sub esp, 8
lea eax, [esp + 0x10]
cmp dword [esp + 0x24], 8
mov ecx, esp
cmovae eax, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x40]
call fcn.00416b30
sub esp, 8
mov edx, esp
cmp dword [eax + 0x14], 8
jb 0x4153b9
mov ecx, dword [eax]
jmp 0x4153bb
mov ecx, eax
mov dword [edx], ecx
lea ecx, [esp + 0x28]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.00416b30
lea ecx, [esp + 0x20]
call fcn.00417a90
lea eax, [esp + 0x20]
cmp esi, eax
je 0x4153e9
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00407f70
lea ecx, [esp + 0x20]
call fcn.004077f0
lea ecx, [esp + 0x38]
call fcn.004077f0
lea ecx, [esp + 8]
call fcn.004077f0
mov al, 1
pop esi
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x25c]
xor al, al
pop esi
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret

Function at 0x415430
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.004179e0
test al, al
jne 0x41549c
mov ecx, esi
call fcn.004179e0
test al, al
jne 0x41549c
cmp dword [edi + 0x10], 0x104
jae 0x41549c
cmp dword [esi + 0x10], 0x104
jae 0x41549c
cmp dword [esi + 0x14], 8
jb 0x415465
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x41546d
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41549c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41549c
test al, 1
je 0x415496
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x4154b0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x10], 0x104
jae 0x415542
cmp dword [edi + 0x10], 0x104
jae 0x415542
cmp dword [edi + 0x14], 8
jb 0x4154d6
mov eax, dword [edi]
jmp 0x4154d8
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x4154e0
mov ecx, dword [esi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4154f6
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
jb 0x41550c
mov eax, dword [esi]
jmp 0x41550e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415530
shr eax, 4
and al, 1
je 0x415530
mov edx, edi
mov ecx, esi
call fcn.00415550
mov bl, al
test bl, bl
jne 0x415539
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419e20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.004ffcc0
mov eax, dword [0x5bf23c]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [0x578e48]
mov esi, eax
test esi, esi
jne 0x419f67
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x419ef4
cmp word [esp + 0x10], ax
jne 0x419eb8
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.00407e70
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x419ec0
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00407e70
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x419f62
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x419f47
cmp eax, 0x400
ja 0x419f47
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.00407e20
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.004ff5c3
mov esp, ebp
pop ebp
ret 8