joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb480
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
mov esi, ecx
push 0x20a
push eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 4]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4bb4f7
xor eax, eax
mov ecx, esi
mov word [esp + 0x20e], ax
lea eax, [esp + 4]
push eax
call fcn.0040bc40
mov al, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00564de8
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
xor al, al
pop esi
xor ecx, esp
call fcn.00564de8
add esp, 0x210
ret

Function at 0x4bb510
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x58e488
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
cmp dword [esi + 0x14], 8
jb 0x4bb555
mov eax, dword [esi]
jmp 0x4bb557
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x4bb56c
mov al, 1
jmp 0x4bb5f6
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x38], eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.004bc9a0
test al, al
je 0x4bb5c0
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push edi
cmovae eax, dword [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x4bb5c0
mov bl, 1
jmp 0x4bb5c2
xor bl, bl
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x4bb5dd
push dword [esp + 0x14]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov al, bl
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00564de8
add esp, 0x2c
ret
Function at 0x4bb620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x58ea48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4bb65c
mov eax, dword [esi]
jmp 0x4bb65e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4bb6f3
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004bc9a0
test al, al
je 0x4bb6c1
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4bb6dc
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00564de8
add esp, 0x28
ret
Function at 0x4bb720
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x58ea80
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x4bb75e
mov eax, dword [edi]
jmp 0x4bb760
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x4bb768
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4bb77b
mov al, 1
jmp 0x4bb8e9
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0xf], 0
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov dword [esp + 0x50], eax
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.004bc9a0
movzx ecx, byte [esp + 0xf]
test al, al
mov edx, 1
mov dword [esp + 0x24], 0
cmovne ecx, edx
mov dword [esp + 0x28], 0
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov byte [esp + 0x50], dl
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.004bc9a0
test al, al
jne 0x4bb809
cmp byte [esp + 0x10], al
je 0x4bb886
cmp dword [esp + 0x28], 8
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
cmovae ecx, dword [esp + 0x14]
cmp dword [esp + 0x40], 8
push ecx
cmovae eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4bb886
mov byte [esp + 0x50], 0
cmp dword [esp + 0x28], 8
jb 0x4bb849
push dword [esp + 0x14]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4bb87b
push dword [esp + 0x2c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov word [esp + 0x2c], ax
mov al, 1
jmp 0x4bb8d9
mov byte [esp + 0x50], 0
cmp dword [esp + 0x28], 8
jb 0x4bb89e
push dword [esp + 0x14]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4bb8d0
push dword [esp + 0x2c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov word [esp + 0x2c], ax
xor al, al
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 7
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00564de8
add esp, 0x48
ret
Function at 0x4bb910
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x58eac8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x4bb94f
mov eax, dword [esi]
jmp 0x4bb951
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x4bb959
mov ecx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0xb
push eax
push ecx
call ebx
test eax, eax
je 0x4bb970
mov al, 1
jmp 0x4bbb53
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x70], eax
lea edx, [esp + 0x4c]
mov ecx, edi
call fcn.004bc9a0
movzx ecx, byte [esp + 0x17]
test al, al
mov edx, 1
mov dword [esp + 0x44], 0
cmovne ecx, edx
mov dword [esp + 0x48], 0
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov byte [esp + 0x70], dl
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.004bc9a0
test al, al
jne 0x4bb9fe
cmp byte [esp + 0x18], al
je 0x4bba2b
cmp dword [esp + 0x48], 8
lea ecx, [esp + 0x34]
push 0xb
cmovae ecx, dword [esp + 0x38]
lea eax, [esp + 0x50]
cmp dword [esp + 0x64], 8
push ecx
cmovae eax, dword [esp + 0x54]
push eax
call ebx
test eax, eax
je 0x4bba2b
mov bl, 1
jmp 0x4bbaf0
mov ecx, esi
call fcn.004bb620
cmp eax, 0xffffffff
je 0x4bbaee
xor eax, eax
mov dword [esp + 0x2c], 0
push 0xffffffffffffffff
push eax
mov dword [esp + 0x38], 0
lea ecx, [esp + 0x24]
push esi
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
call fcn.00404960
mov byte [esp + 0x70], 2
lea ecx, [esp + 0x1c]
call fcn.004bc670
test al, al
je 0x4bbabf
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.004bb720
test al, al
je 0x4bbabf
mov edx, esi
mov ecx, edi
call fcn.004bb720
lea ecx, [esp + 0x1c]
test al, al
je 0x4bbab8
call fcn.004bbf20
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x1c]
call fcn.00403b40
mov bl, 1
jmp 0x4bbaf0
mov edx, esi
call fcn.004bb720
mov byte [esp + 0x70], 1
cmp dword [esp + 0x30], 8
jb 0x4bbad7
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
xor bl, bl
mov byte [esp + 0x70], 0
cmp dword [esp + 0x48], 8
jb 0x4bbb08
push dword [esp + 0x34]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x60], 8
jb 0x4bbb3a
push dword [esp + 0x4c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov word [esp + 0x4c], ax
mov al, bl
mov dword [esp + 0x5c], 0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00564de8
add esp, 0x64
ret
Function at 0x4bbb80
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x58eb00
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x4bbbbf
mov eax, dword [edi]
jmp 0x4bbbc1
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x4bbbc9
mov ecx, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push eax
push ecx
call ebx
test eax, eax
je 0x4bbbe0
mov al, 1
jmp 0x4bbcfd
xor eax, eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x58], eax
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.004bc9a0
movzx ecx, byte [esp + 0x17]
test al, al
mov edx, 1
mov dword [esp + 0x2c], 0
cmovne ecx, edx
mov dword [esp + 0x30], 0
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x58], dl
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.004bc9a0
test al, al
jne 0x4bbc6e
cmp byte [esp + 0x18], al
je 0x4bbc98
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x1c]
push 0
cmovae ecx, dword [esp + 0x20]
lea eax, [esp + 0x38]
cmp dword [esp + 0x4c], 8
push ecx
cmovae eax, dword [esp + 0x3c]
push eax
call ebx
test eax, eax
je 0x4bbc98
mov bl, 1
jmp 0x4bbc9a
xor bl, bl
mov byte [esp + 0x58], 0
cmp dword [esp + 0x30], 8
jb 0x4bbcb2
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x48], 8
jb 0x4bbce4
push dword [esp + 0x34]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov word [esp + 0x34], ax
mov al, bl
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00564de8
add esp, 0x4c
ret
Function at 0x4bbd20
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x58ea48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4bbd5c
mov eax, dword [esi]
jmp 0x4bbd5e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4bbd70
mov al, 1
jmp 0x4bbdfd
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004bc9a0
test al, al
je 0x4bbdc7
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4bbdc7
mov bl, 1
jmp 0x4bbdc9
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4bbde4
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00564de8
add esp, 0x28
ret

Function at 0x4bbe20
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x58ea48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4bbe5c
mov eax, dword [esi]
jmp 0x4bbe5e
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4bbe72
mov al, 1
jmp 0x4bbf01
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004bc9a0
test al, al
je 0x4bbecb
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4bbecb
mov bl, 1
jmp 0x4bbecd
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4bbee8
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00564de8
add esp, 0x28
ret
Function at 0x4bbf20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58eb50
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4bbf63
mov eax, dword [esi]
jmp 0x4bbf65
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4bbf79
mov al, 1
jmp 0x4bc13c
cmp dword [esi + 0x14], 8
jb 0x4bbf83
mov edx, dword [esi]
jmp 0x4bbf85
mov edx, esi
xor eax, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
cmp word [edx], ax
jne 0x4bbfb5
xor ecx, ecx
jmp 0x4bbfcf
mov ecx, edx
lea ebx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bbfc0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.00404a80
mov dword [esp + 0x58], 0
lea ecx, [esp + 0x30]
call fcn.004bb620
mov ebx, eax
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x4bc008
push dword [esp + 0x30]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
cmp ebx, 0xffffffff
jne 0x4bc02b
xor al, al
jmp 0x4bc13c
cmp dword [esi + 0x14], 8
jb 0x4bc035
mov eax, dword [esi]
jmp 0x4bc037
mov eax, esi
push eax
lea ecx, [esp + 0x34]
call fcn.00403a70
mov dword [esp + 0x58], 1
xor edx, edx
lea ecx, [esp + 0x30]
call fcn.004bb510
test al, al
sete al
mov byte [esp + 0x17], al
mov dword [esp + 0x58], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x4bc07c
push dword [esp + 0x30]
call fcn.00564de3
mov al, byte [esp + 0x1b]
add esp, 4
xor ecx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], cx
test al, al
jne 0x4bc024
cmp dword [esi + 0x14], 8
jb 0x4bc0a1
mov eax, dword [esi]
jmp 0x4bc0a3
mov eax, esi
push eax
call edi
test eax, eax
jne 0x4bbf72
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], eax
mov word [esp + 0x30], ax
mov dword [esp + 0x58], 2
lea edx, [esp + 0x30]
mov ecx, esi
call fcn.004bc9a0
test al, al
je 0x4bc0f7
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push eax
call edi
test eax, eax
je 0x4bc0f7
mov bl, 1
jmp 0x4bc129
cmp dword [esi + 0x14], 8
jb 0x4bc0ff
mov esi, dword [esi]
push esi
lea ecx, [esp + 0x1c]
call fcn.00403a70
mov byte [esp + 0x58], 3
mov edx, ebx
lea ecx, [esp + 0x18]
call fcn.004bb510
mov byte [esp + 0x58], 2
lea ecx, [esp + 0x18]
call fcn.00403b40
xor bl, bl
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00403b40
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret
Function at 0x4bc160
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x58eb8b
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x624], eax
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x630]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x7e1988]
mov dword [esp + 8], 0x7e1988
test eax, eax
je 0x4bc1b2
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x638], 0
cmp dword [0x5e4084], 0
je 0x4bc200
cmp esi, 0x5e4074
je 0x4bc1de
push 0xffffffffffffffff
push 0
push 0x5e4074
mov ecx, esi
call fcn.00404960
mov dword [esp + 0x638], 0xffffffff
mov eax, dword [0x7e1988]
test eax, eax
je 0x4bc1f9
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x4bc2db
xor eax, eax
push 0x20a
push eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4bc2be
xor eax, eax
push 0x410
push eax
mov word [esp + 0x21e], ax
mov word [esp + 0x220], ax
lea eax, [esp + 0x222]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x218]
push 0x208
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4bc2ad
test eax, eax
je 0x4bc2ad
add eax, eax
cmp eax, 0x412
jae 0x4bc2a8
xor ecx, ecx
mov word [esp + eax + 0x218], cx
lea eax, [esp + 0x218]
push eax
mov ecx, esi
call fcn.0040bc40
jmp 0x4bc1de
call fcn.0056582e
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0040bc40
jmp 0x4bc1de
mov dword [esp + 0x638], 0xffffffff
mov eax, dword [0x7e1988]
test eax, eax
je 0x4bc2d9
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov dword [esp + 8], 0
mov ecx, dword [esp + 0x630]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x624]
xor ecx, esp
call fcn.00564de8
add esp, 0x634
ret
Function at 0x4bc310
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
xor eax, eax
push esi
push edi
push 0x20a
push eax
mov word [esp + 0x14], ax
mov edi, edx
lea eax, [esp + 0x16]
mov esi, ecx
push eax
call fcn.0056cbb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4bc354
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x4bc35c
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4bc3e6
xor eax, eax
mov word [esp + 0x216], ax
cmp word [esp + 0xc], ax
jne 0x4bc3a9
xor ecx, ecx
lea eax, [esp + 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.00404a80
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00564de8
add esp, 0x210
ret
lea ecx, [esp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4bc3b0
sub ecx, edx
lea eax, [esp + 0xc]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00404a80
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00564de8
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00564de8
add esp, 0x210
ret

Function at 0x4bc5c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x4bc5e8
mov eax, dword [esi]
jmp 0x4bc5ea
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
push 0x410
push eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4bc635
xor al, al
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.00564de8
add esp, 0x418
ret
cmp eax, 0x208
jae 0x4bc61d
xor eax, eax
mov ecx, esi
mov word [esp + 0x414], ax
lea eax, [esp + 4]
push eax
call fcn.0040bc40
mov ecx, dword [esp + 0x418]
mov al, 1
pop esi
xor ecx, esp
call fcn.00564de8
add esp, 0x418
ret
Function at 0x4bd1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x7e1e20], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x7e1f20], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x7e2020], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x7e1d20], al
inc esi
cmp esi, 0x100
jl 0x4bd2d0
pop esi
add esp, 0x80
ret