joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422a2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00462010
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
push ebx
mov ebx, dword [ebp + 0xc]
push edi
jb 0x422a51
mov eax, dword [eax]
push 0x40
push 0x49d91c
push eax
call fcn.00462fb4
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x422a6b
xor al, al
jmp 0x422aa5
push esi
mov esi, 0x10000
jmp 0x422a86
test ebx, ebx
je 0x422a86
push eax
lea eax, [ebp - 0x10004]
push eax
mov ecx, ebx
call fcn.0042101e
push edi
push esi
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.004675f3
add esp, 0x10
test eax, eax
jne 0x422a73
push edi
call fcn.00462d6f
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00461ffa
leave
ret

Function at 0x4237d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a4
call fcn.00462010
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20a0], eax
xor eax, eax
push 0x2090
push eax
mov word [ebp - 0x2098], ax
lea eax, [ebp - 0x2096]
push eax
call fcn.00461390
add esp, 0xc
lea eax, [ebp - 0x20a4]
push eax
lea eax, [ebp - 0x2098]
push eax
lea eax, [ebp - 0x209c]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x209c], 1
mov dword [ebp - 0x20a4], 0x1048
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x423882
cmp ax, word [ebp - 0x2098]
je 0x423882
lea eax, [ebp - 0x2098]
push eax
call fcn.00461f93
pop ecx
mov ecx, dword [ebp - 0x20a0]
push eax
lea eax, [ebp - 0x2098]
push eax
call fcn.00420af5
xor eax, eax
inc eax
jmp 0x423884
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461ffa
leave
ret
Function at 0x424b6b
Capabilities:
Enumerate processes

Disassembly:
push 0x248
mov eax, 0x495612
call fcn.004626c9
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], edi
push edi
push 2
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x244], ebx
cmp ebx, 0xffffffff
je 0x424c3b
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x424bd1
push ebx
jmp 0x424c35
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.004130cd
mov eax, dword [eax]
push str.360se.exe
push eax
call fcn.00461ee1
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0x240]
sbb bl, bl
call fcn.0040e14c
inc bl
je 0x424c19
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00424022
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x424bd1
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x254]
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0042416f
lea ecx, [ebp - 0x254]
call fcn.00422dce
mov eax, esi
call fcn.0046274c
ret

Function at 0x424c64
Capabilities:
Enumerate processes

Disassembly:
push 0x248
mov eax, 0x495645
call fcn.004626c9
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], edi
push edi
push 2
mov dword [ebp - 4], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
mov dword [ebp - 0x244], ebx
cmp ebx, 0xffffffff
je 0x424d34
lea eax, [ebp - 0x23c]
push eax
push ebx
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x424cca
push ebx
jmp 0x424d2e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
call fcn.004130cd
mov eax, dword [eax]
push str.360chrome.exe
push eax
call fcn.00461ee1
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0x240]
sbb bl, bl
call fcn.0040e14c
inc bl
je 0x424d12
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x254]
call fcn.00424022
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x244]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x424cca
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x254]
push eax
mov ecx, esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0042416f
lea ecx, [ebp - 0x254]
call fcn.00422dce
mov eax, esi
call fcn.0046274c
ret
Function at 0x425bb2
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x270
mov eax, 0x495a15
call fcn.004626c9
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x270], ebx
push 0x49de38
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 4], ebx
call fcn.004131e3
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x26c]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x425d53
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x268]
call fcn.004130cd
test byte [ebp - 0x260], 0x10
mov byte [ebp - 4], 2
je 0x425d06
push 0x49bf30
lea ecx, [ebp - 0x278]
call fcn.004130cd
lea ecx, [ebp - 0x268]
push ecx
or ebx, 1
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x270], ebx
call fcn.0041de03
test al, al
je 0x425c82
push 0x49bf28
lea ecx, [ebp - 0x27c]
call fcn.004130cd
lea ecx, [ebp - 0x268]
push ecx
push eax
or ebx, 2
call fcn.0041de03
mov byte [ebp - 0x261], 1
test al, al
jne 0x425c89
mov byte [ebp - 0x261], 0
test bl, 2
je 0x425c9c
lea ecx, [ebp - 0x27c]
and ebx, 0xfffffffd
call fcn.0040e14c
mov dword [ebp - 4], 2
test bl, 1
je 0x425cb6
lea ecx, [ebp - 0x278]
and ebx, 0xfffffffe
call fcn.0040e14c
cmp byte [ebp - 0x261], 0
je 0x425d06
push esi
push 0x49bf18
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.004131e3
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
lea edx, [ebp - 0x268]
push edx
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.0041319b
call fcn.00425bb2
pop ecx
pop ecx
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 2
call fcn.0040e14c
push str.manifest.json
push dword [ebp - 0x268]
call fcn.00461ee1
pop ecx
pop ecx
test eax, eax
jne 0x425d27
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00417e7e
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.0040e14c
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x425c06
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x26c]
call fcn.0040e14c
lea ecx, [ebp + 8]
call fcn.0040e14c
call fcn.0046274c
ret
Function at 0x4261ba
Capabilities:
Enumerate process modules

Disassembly:
push 0x44c
mov eax, 0x495b40
call fcn.004626c9
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
push eax
push 8
mov dword [ebp - 4], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4262ea
lea eax, [ebp - 0x438]
push eax
push edi
mov dword [ebp - 0x438], 0x428
call sub.KERNEL32.dll_Module32FirstW
jmp 0x4262db
mov eax, dword [0x4bd024]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 1
call fcn.00411a2b
push ecx
lea eax, [ebp - 0x440]
mov ecx, esp
mov dword [ebp - 0x458], esp
push eax
call fcn.00413097
lea eax, [ebp - 0x444]
push eax
call fcn.00422438
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 2
call fcn.004119d8
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 1
call fcn.0040e14c
push ecx
lea eax, [ebp - 0x43c]
mov ecx, esp
mov dword [ebp - 0x458], esp
push eax
call fcn.00413097
call fcn.0042228a
pop ecx
cmp al, bl
jne 0x4262b5
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x454]
call fcn.00425d6c
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], bl
call fcn.0040e14c
lea ecx, [ebp - 0x440]
call fcn.0040e14c
lea eax, [ebp - 0x438]
push eax
push edi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x42621b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x454]
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00425e5e
lea ecx, [ebp - 0x454]
call fcn.00424a6a
mov eax, esi
call fcn.0046274c
ret

Function at 0x427c98
Capabilities:
Check if file exists

Disassembly:
push 0x214
mov eax, 0x49609e
call fcn.004626c9
mov esi, dword [ebp + 8]
mov ebx, ecx
push esi
lea ecx, [ebp - 0x220]
call fcn.00413097
push dword [esi]
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x427d37
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.00461390
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, edi
jle 0x427d37
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00411a2b
push str.Utils360FeedBack.xml
lea ecx, [ebp - 0x220]
call fcn.0040fe97
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x427d57
lea eax, [ebp - 0x220]
push eax
mov ecx, ebx
call fcn.00427bc6
mov edi, eax
lea ecx, [ebp - 0x220]
call fcn.0040e14c
mov eax, edi
call fcn.0046274c
ret 4

Function at 0x4280cb
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x428d7e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x428d8b
lea esi, [ecx - 0x20]
jmp 0x428d8d
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x428dc1
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x428db2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x428dc7
cmp dword [ebp + 0xc], 0
jne 0x428dc1
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x428ddc
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x20]
call fcn.0042876f
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x42988c
Capabilities:
Get graphical window text

Disassembly:
push 0x80c
mov eax, 0x49621e
call fcn.004626c9
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
mov esi, ecx
call fcn.00461390
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 0x485
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push eax
call ebx
xor ecx, ecx
mov word [ebp + eax*2 - 0x810], cx
lea eax, [ebp - 0x810]
lea ecx, [esi + 0x60]
push eax
call fcn.00411a2b
push 0
push 0
push 0x147
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x486
push dword [esi + 4]
mov dword [ebp - 0x818], eax
call edi
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push eax
call ebx
xor ecx, ecx
mov word [ebp + eax*2 - 0x810], cx
lea eax, [ebp - 0x810]
push eax
lea ecx, [esi + 0x64]
call fcn.00411a2b
mov ebx, 0x49d354
push ebx
lea ecx, [esi + 0x64]
call fcn.00428e62
push ebx
lea ecx, [esi + 0x64]
call fcn.00428de3
mov eax, dword [esi + 0x64]
xor ebx, ebx
cmp dword [eax - 8], ebx
je 0x4299d4
call fcn.0040dd4e
add eax, 8
push eax
lea ecx, [ebp - 0x814]
call fcn.00413097
push ebx
push ebx
push 0x146
push dword [esi + 0x50]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + 0x64]
dec eax
cmp dword [ebp - 0x818], eax
lea eax, [esi + 0x54]
jge 0x4299b3
push dword [esi + 0x60]
push dword [ebp - 0x814]
push 0x9c71
push eax
call fcn.0042948e
add esp, 0x14
jmp 0x4299c7
push dword [ebp - 0x814]
push 0x9c8c
push eax
call fcn.0042948e
add esp, 0x10
lea ecx, [ebp - 0x814]
call fcn.0040e14c
jmp 0x4299dc
lea ecx, [esi + 0x54]
call fcn.00429470
mov esi, dword [esi + 0x58]
cmp esi, ebx
je 0x4299f1
push ebx
push ebx
push 0xc4c
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0046274c
ret
Function at 0x4299f7
Capabilities:
Get graphical window text

Disassembly:
push 0x808
mov eax, 0x496251
call fcn.004626c9
cmp dword [ebp + 8], 0x300
mov ebx, ecx
jne 0x429ac0
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.00461390
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 0x486
push dword [ebx + 4]
call esi
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x810], cx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.004130cd
and dword [ebp - 4], 0
mov edi, 0x49d354
push edi
lea ecx, [ebp - 0x814]
call fcn.00428e62
push edi
lea ecx, [ebp - 0x814]
call fcn.00428de3
mov eax, dword [ebp - 0x814]
cmp dword [eax - 8], 0
push 1
push dword [ebx + 4]
je 0x429aaa
call esi
push 1
jmp 0x429aae
call esi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea ecx, [ebp - 0x814]
call fcn.0040e14c
call fcn.0046274c
ret 0xc

Function at 0x429b89
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0042988c
push 7
call fcn.004427a9
pop ecx
pop esi
ret

Function at 0x429cdb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
push ebx
push esi
push edi
mov esi, ecx
jne 0x429d75
cmp dword [eax + 8], 0xd
jne 0x429d5d
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x486
push ebx
push dword [esi - 0x44]
mov dword [ebp - 0x70], eax
call edi
cmp dword [ebp - 0x70], eax
jne 0x429d5a
xor eax, eax
push 0x64
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call fcn.00461390
add esp, 0xc
push ebx
push dword [esi - 0x44]
call edi
push 0x32
lea ecx, [ebp - 0x6c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x429d55
lea ecx, [esi - 0x48]
call fcn.00429b89
xor eax, eax
inc eax
jmp 0x429d77
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0x1b
jne 0x429d75
push 0
push 0
push 0x1418
push dword [esi - 0x44]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461ffa
leave
ret 4
Function at 0x42acc2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
push edi
xor edi, edi
cmp eax, edi
jle 0x42ad41
cmp dword [esi + 0x50], edi
je 0x42ad41
xor ebx, ebx
cmp eax, edi
jle 0x42ad9c
lea eax, [ebx + 0x46d]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
test eax, eax
je 0x42ad9c
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x50]
lea eax, [edi + eax + 4]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi + 0x50]
push dword [edi + eax]
push 0xfffffffffffffff4
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [ebp - 4]
mov ecx, esi
push dword [esi + 4]
call fcn.0042aa77
inc ebx
add edi, 0x44
cmp ebx, dword [esi + 0x54]
jl 0x42ace3
jmp 0x42ad9c
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x46d
push ebx
push dword [esi + 4]
call edi
push 0x49df88
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
push dword [esi + 4]
call edi
push 1
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push ebx
push dword [esi + 4]
call edi
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [esi + 4]
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42b150
Capabilities:
Get graphical window text

Disassembly:
push 0x214
mov eax, 0x4963bb
call fcn.004626c9
mov edi, dword [0x4c7d4c]
mov esi, ecx
lea eax, [esi + 0x48]
push eax
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x220], edi
call fcn.00413097
and dword [ebp - 4], 0
push edi
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x29cd
test eax, eax
je 0x42b223
mov eax, dword [esi + 0x48]
cmp dword [eax - 8], 0
jne 0x42b1eb
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00461390
add esp, 0xc
push 0x100
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.00411a2b
and dword [ebp - 0x21c], 0
push 0x494
push dword [esi + 4]
call edi
lea ecx, [ebp - 0x21c]
push ecx
push ebx
push eax
call fcn.0042addd
mov eax, dword [ebp - 0x21c]
add esp, 0xc
test eax, eax
je 0x42b223
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
and dword [ebp - 0x218], 0
push 0x487
push dword [esi + 4]
call edi
lea ecx, [ebp - 0x218]
push ecx
push ebx
push eax
call fcn.0042addd
mov eax, dword [ebp - 0x218]
add esp, 0xc
test eax, eax
je 0x42b266
mov ecx, dword [eax]
push 6
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x218]
push dword [esi + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea ecx, [ebp - 0x214]
call fcn.0040e14c
call fcn.0046274c
ret
Function at 0x42bc89
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c6260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.00461390
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00461390
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041c38b
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x20]
call fcn.00411a2b
push dword [esi + 0x20]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42bd08
push eax
push dword [esi + 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00461ffa
leave
ret
Function at 0x42c0bb
Capabilities:
Check if file exists

Disassembly:
push 0x22c
mov eax, 0x49651f
call fcn.004626c9
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
and dword [ebp - 0x22c], 0
lea eax, [ebx + 0xc]
mov edi, ecx
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x238], esi
call fcn.00413097
push 0x49bf18
lea eax, [edi + 0x20]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 4], 1
call fcn.004131e3
mov dword [ebp - 0x224], eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [ebp - 0x224]
push esi
call fcn.004131e3
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x22c], 1
mov byte [ebp - 4], 1
call fcn.0040e14c
mov ebx, dword [ebx]
cmp ebx, 1
je 0x42c156
cmp ebx, 6
jne 0x42c1b8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00461390
mov eax, dword [esi]
add esp, 0xc
push dword [eax - 8]
mov ecx, esi
call fcn.0040febf
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00463101
pop ecx
pop ecx
push str..zip
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.004111f6
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00411a2b
push esi
lea ecx, [ebp - 0x220]
call fcn.00413097
mov eax, dword [ebp - 0x220]
push dword [eax - 8]
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.0040febf
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.004111f6
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x224]
call fcn.004130cd
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 4
jmp 0x42c29f
mov eax, dword [0x4bd024]
mov dword [ebp - 0x21c], eax
push dword [edi + 0x24]
lea eax, [ebp - 0x21c]
push 0x49dfb4
push eax
mov byte [ebp - 4], 5
call fcn.00413187
add esp, 0xc
inc dword [edi + 0x24]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0041319b
lea ecx, [ebp - 0x224]
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
mov byte [ebp - 4], 6
call fcn.0041319b
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004119d8
lea ecx, [ebp - 0x230]
call fcn.0040e14c
lea ecx, [ebp - 0x234]
call fcn.0040e14c
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.0040e14c
push dword [esi]
call ebx
test eax, eax
jne 0x42c213
lea ecx, [ebp - 0x224]
call fcn.0040e14c
lea ecx, [ebp - 0x220]
call fcn.0040e14c
lea ecx, [ebp - 0x228]
call fcn.0040e14c
mov eax, esi
call fcn.0046274c
ret 8
Function at 0x42c8f3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
push edi
mov edi, ecx
mov ecx, dword [eax]
mov dword [ebp - 8], edi
test ecx, ecx
jne 0x42c981
lea esi, [eax + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c928
mov dword [ebp - 4], 6
jmp 0x42caa8
push esi
mov ecx, edi
call fcn.0042c6e3
test eax, eax
je 0x42c940
mov dword [ebp - 4], 5
jmp 0x42caa8
push 0
mov ecx, edi
call fcn.0042bb4c
push 3
pop edi
cmp eax, edi
jl 0x42c95c
mov dword [ebp - 4], 2
jmp 0x42caa8
push dword [esi]
call fcn.0041b912
pop ecx
test edx, edx
jl 0x42caa8
jg 0x42c979
cmp eax, 0x100000
jbe 0x42caa8
mov dword [ebp - 4], edi
jmp 0x42caa8
push ebx
cmp ecx, 1
jne 0x42ca16
lea esi, [eax + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c9a6
mov dword [ebp - 4], 6
jmp 0x42caa7
push esi
mov ecx, edi
call fcn.0042c6e3
test eax, eax
jne 0x42ca41
push 1
mov ecx, edi
call fcn.0042bb4c
cmp eax, 3
jge 0x42ca57
push dword [esi]
call fcn.0041b912
mov esi, edx
pop ecx
mov edi, eax
mov ebx, 0x500000
test esi, esi
jl 0x42c9eb
jg 0x42ca7b
cmp edi, ebx
ja 0x42ca7b
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0042c85a
mov ecx, dword [eax]
mov eax, dword [eax + 4]
add ecx, edi
adc eax, esi
mov dword [ebp - 8], eax
js 0x42caa7
jg 0x42caa0
cmp ecx, ebx
jmp 0x42ca9e
push 6
pop ebx
cmp ecx, ebx
jne 0x42caa7
lea esi, [eax + 0xc]
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42ca35
mov dword [ebp - 4], ebx
jmp 0x42caa7
push esi
mov ecx, edi
call fcn.0042c6e3
test eax, eax
je 0x42ca4a
mov dword [ebp - 4], 5
jmp 0x42caa7
push ebx
mov ecx, edi
call fcn.0042bb4c
cmp eax, 3
jl 0x42ca60
mov dword [ebp - 4], 4
jmp 0x42caa7
push dword [esi]
call fcn.0041b912
mov esi, edx
pop ecx
mov edi, eax
mov ebx, 0x500000
test esi, esi
jl 0x42ca84
jg 0x42ca7b
cmp edi, ebx
jbe 0x42ca84
mov dword [ebp - 4], 7
jmp 0x42caa7
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0042c85a
add edi, dword [eax]
adc esi, dword [eax + 4]
mov dword [ebp - 8], esi
js 0x42caa7
jg 0x42caa0
cmp edi, ebx
jbe 0x42caa7
mov dword [ebp - 4], 8
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x42cab1
Capabilities:
Copy file

Disassembly:
push 8
mov eax, 0x49673e
call fcn.00462660
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.0042c0bb
mov eax, dword [esi]
and dword [ebp - 4], 0
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
test eax, eax
jne 0x42caf5
mov eax, dword [edi]
mov esi, dword [esi + 0xc]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x42cb0b
cmp eax, ecx
je 0x42cafe
cmp eax, 6
jne 0x42cb0b
mov ecx, dword [ebp - 0x10]
push edi
add esi, 0xc
push esi
call fcn.0042b623
mov eax, edi
call fcn.00462738
ret 8