joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435280
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0d06
mov eax, dword fs:[0]
push eax
mov eax, 0x20cc
call fcn.005965e0
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0xc4c]
push 0x5cc7f4
push eax
push str._s_sfonts.ini
mov esi, 0x400
lea edi, [ebp - 0x810]
mov dword [ebp - 0x20cc], eax
call fcn.004f9520
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
add ebx, 0x1454
push ebx
mov ecx, str.GenerateSubstituteFonts
call fcn.004fd0e0
xor ebx, ebx
cmp eax, ebx
je 0x4354f3
mov dword [ebp - 0x20d0], ebx
cmp eax, 2
jne 0x435319
mov dword [ebp - 0x20d0], 1
mov esi, vtable.WindowsFile.0
mov dword [ebp - 0xc8c], ebx
mov dword [ebp - 0xc90], esi
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0xc84], ebx
mov byte [ebp - 0xc7c], bl
mov byte [ebp - 0x87c], bl
lea ecx, [ebp - 0x810]
push ecx
push 0x5c7d4c
push str.cotrwRW
lea edi, [ebp - 0xc90]
mov dword [ebp - 4], ebx
call fcn.00508fc0
add esp, 0xc
cmp dword [ebp - 0xc80], ebx
jne 0x4354e2
lea edx, [ebp - 0x858]
push edx
call fcn.0050a480
mov edx, dword [ebp - 0x20cc]
lea eax, [ebp - 0x10a0]
push eax
push 0x5cac84
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 1
call fcn.0050a5e0
mov dword [ebp - 0x20d4], eax
cmp eax, ebx
je 0x4354cc
nop
mov byte [ebp - 0x410], bl
cmp byte [ebp - 0xc98], bl
jne 0x43549a
mov edi, str..ttf
lea ebx, [ebp - 0x10a0]
call fcn.004015d0
test eax, eax
je 0x4353e4
mov edx, dword [ebp - 0x20cc]
push 0
mov ecx, ebx
push ecx
push edx
jmp 0x435448
lea eax, [ebp - 0x10a0]
push 0x2e
push eax
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
jne 0x43545e
lea eax, [ebp - 0x10a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435403
sub eax, edx
cmp eax, 8
ja 0x43545e
mov edi, 0x5cc480
lea ebx, [ebp - 0x10a0]
call fcn.00401670
test eax, eax
jne 0x435433
mov edi, 0x5cc208
call fcn.00401670
test eax, eax
je 0x43545e
mov ecx, dword [ebp - 0x20d0]
mov eax, dword [ebp - 0x20cc]
push ecx
lea edx, [ebp - 0x10a0]
push edx
push eax
lea esi, [ebp - 0x20c8]
call fcn.0050bcc0
lea ecx, [ebp - 0x410]
call fcn.0050c950
cmp byte [ebp - 0x410], 0
je 0x435498
mov edx, dword [ebp - 0xc90]
mov eax, dword [edx + 0x38]
push 2
push 0
push 0
lea ecx, [ebp - 0xc90]
call eax
lea ecx, [ebp - 0x410]
push ecx
push 0x5cc484
lea esi, [ebp - 0xc90]
call fcn.00506ab0
add esp, 8
xor ebx, ebx
mov esi, dword [ebp - 0x20d4]
push esi
lea edx, [ebp - 0x10a0]
lea ecx, [ebp - 0x858]
call fcn.0050a8d0
test al, al
jne 0x4353b0
mov eax, esi
lea esi, [ebp - 0x858]
call fcn.0050aa00
mov esi, vtable.WindowsFile.0
lea ecx, [ebp - 0xc90]
call fcn.005096c0
lea ecx, [ebp - 0x858]
call fcn.0050a540
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0xc90], esi
call fcn.005096c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x436da0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a0c86
mov eax, dword fs:[0]
push eax
mov eax, 0x1cb4
call fcn.005965e0
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0xc4c]
push 0x5cc7f4
push eax
push str._s_sfonts.ini
mov esi, 0x400
lea edi, [ebp - 0x810]
mov dword [ebp - 0x1cb8], eax
call fcn.004f9520
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
add ebx, 0x1454
push ebx
mov ecx, str.GenerateSubstituteFonts
call fcn.004fd0e0
xor ebx, ebx
cmp eax, ebx
je 0x436fdf
mov dword [ebp - 0x1cb4], ebx
cmp eax, 2
jne 0x436e39
mov dword [ebp - 0x1cb4], 1
mov esi, vtable.WindowsFile.0
mov dword [ebp - 0xc8c], ebx
mov dword [ebp - 0xc90], esi
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0xc84], ebx
mov byte [ebp - 0xc7c], bl
mov byte [ebp - 0x87c], bl
lea ecx, [ebp - 0x810]
push ecx
push 0x5c7d4c
push str.cotrwRW
lea edi, [ebp - 0xc90]
mov dword [ebp - 4], ebx
call fcn.00508fc0
add esp, 0xc
cmp dword [ebp - 0xc80], ebx
jne 0x436fce
lea edx, [ebp - 0x858]
push edx
call fcn.0050a480
mov edx, dword [ebp - 0x1cb8]
lea eax, [ebp - 0x10a0]
push eax
push 0x5cc5e8
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 1
call fcn.0050a5e0
mov dword [ebp - 0x1cbc], eax
cmp eax, ebx
je 0x436fb8
jmp 0x436ed3
xor ebx, ebx
cmp byte [ebp - 0xc98], bl
jne 0x436f86
mov edi, str..fnt
lea ebx, [ebp - 0x10a0]
call fcn.004015d0
test eax, eax
je 0x436f86
mov edi, str.formsx
call fcn.00401670
test eax, eax
jne 0x436f86
mov ecx, dword [ebp - 0x1cb8]
push ecx
mov esi, ebx
lea eax, [ebp - 0x1cb0]
call fcn.0050e070
mov esi, dword [ebp - 0x1cb4]
mov edx, esi
lea eax, [ebp - 0x410]
lea ecx, [ebp - 0x1cb0]
mov byte [ebp - 0x410], 0
call fcn.0050e390
mov edx, dword [ebp - 0xc90]
mov eax, dword [edx + 0x38]
push 2
push 0
push 0
lea ecx, [ebp - 0xc90]
call eax
lea eax, [ebp - 0x410]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x436f60
sub eax, edx
push eax
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0xc90]
call fcn.00509a60
test esi, esi
je 0x436f86
inc dword [ebp - 0x1cb4]
mov esi, dword [ebp - 0x1cbc]
push esi
lea edx, [ebp - 0x10a0]
lea ecx, [ebp - 0x858]
call fcn.0050a8d0
test al, al
jne 0x436ed1
mov eax, esi
lea esi, [ebp - 0x858]
call fcn.0050aa00
mov esi, vtable.WindowsFile.0
lea ecx, [ebp - 0xc90]
call fcn.005096c0
lea ecx, [ebp - 0x858]
call fcn.0050a540
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0xc90], esi
call fcn.005096c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x4389b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x4389ca
mov dword [edi], eax
mov dword [edi + 4], eax
push ebx
push 0x18
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov ebx, eax
xor ecx, ecx
add esp, 4
cmp ebx, ecx
je 0x4389eb
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, ebx
xor ecx, ecx
jmp 0x4389ed
xor eax, eax
mov dword [esi + 0x10], eax
lea eax, [ebp - 8]
push eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop ebx
test eax, eax
jne 0x438a1b
xor ecx, ecx
mov dword [edi + 4], eax
mov dword [edi], ecx
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [edi + 4], eax
mov dword [edi], ecx
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x439e60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a2ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea eax, [esi + 0xc30]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
test eax, eax
je 0x439ea9
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
mov eax, dword [esi + 0xc38]
mov edi, dword [eax]
cmp edi, eax
je 0x439fb1
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [edi + 0x10]
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
jne 0x439edd
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
jne 0x439ef4
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jmp 0x439efc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esi + 8]
mov edx, dword [0x61023c]
sbb eax, dword [esi + 0xc]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
mov ebx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x40c]
mov ecx, edx
cdq
cmp ecx, edx
jl 0x439f3c
jg 0x439f30
cmp ebx, eax
jbe 0x439f3c
cmp dword [esi], 0
mov dword [esi + 4], 1
je 0x439f94
cmp byte [edi + 0x15], 0
jne 0x439f82
mov eax, dword [edi + 8]
cmp byte [eax + 0x15], 0
jne 0x439f61
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x15], 0
jne 0x439f82
mov edi, eax
mov eax, dword [edi]
cmp byte [eax + 0x15], 0
je 0x439f55
jmp 0x439f82
mov eax, dword [edi + 4]
cmp byte [eax + 0x15], 0
jne 0x439f80
lea ebx, [ebx]
cmp edi, dword [eax + 8]
jne 0x439f80
mov edi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x439f70
mov edi, eax
mov ecx, dword [esp + 0x14]
cmp edi, dword [ecx + 0xc38]
jne 0x439ec1
jmp 0x439fb1
push edi
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
lea eax, [edi + 0xc34]
push eax
call fcn.004a2050
mov eax, edi
call fcn.00439b40
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
test eax, eax
je 0x439fc2
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b030
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5975e8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0x18
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x44b074
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
jmp 0x44b076
xor eax, eax
mov dword [edi], eax
lea esi, [edi + 0x808]
mov dword [ebp - 4], 0
call fcn.0044cea0
lea esi, [edi + 4]
push 0x400
mov eax, esi
call fcn.00508eb0
push 0x400
mov ebx, str.cache
mov eax, esi
call fcn.00401570
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x400
mov ebx, 0x5cc7f4
mov eax, esi
call fcn.00401570
lea esi, [edi + 0x404]
push 0x400
mov eax, esi
call fcn.00508eb0
push 0x400
mov ebx, str.temp
mov eax, esi
call fcn.00401570
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x400
mov ebx, 0x5cc7f4
mov eax, esi
call fcn.00401570
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44b1e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fa2b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x154], eax
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 0x150], ecx
test eax, eax
je 0x44b22d
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x150]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x44b25d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44b255
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x44b25d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [esi]
test esi, esi
je 0x44b26a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x44b310
push str.unable_to_rename_JPEG_image_cache_temporary
mov eax, 0x13d80
lea ecx, [ebp - 0x14c]
call fcn.005064b0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.005067d0
push ebx
push str.from
mov esi, eax
push str._s___s_
call fcn.00506600
mov eax, dword [ebp - 0x150]
push eax
push 0x5c9624
push str._s___s_
call fcn.00506600
mov ecx, dword [esi]
mov edx, dword [esi + 0x108]
push ecx
push edx
push 0x5cb5f8
mov ecx, 0x610240
call fcn.00504670
add esp, 0x24
cmp dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
je 0x44b2f4
mov esi, dword [esi + 0x118]
jmp 0x44b2f6
xor esi, esi
mov eax, dword [ebp - 0x154]
mov dword [eax], esi
lea esi, [ebp - 0x14c]
mov dword [ebp - 4], 0xffffffff
call fcn.00506520
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
Function at 0x44c580
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59df1b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x444], ebx
mov dword [ebp - method.WindowsFile.virtual_0], vtable.WindowsFile.0
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 0x434], bl
mov byte [ebp - 0x34], bl
push eax
push 0x5c7d4c
push 0x5cc214
lea edi, [ebp - 0x448]
mov dword [ebp - 4], ebx
call fcn.00508fc0
mov eax, dword [ebp - 0x438]
add esp, 0xc
cmp eax, ebx
je 0x44c61a
mov ecx, dword [ebp - 0x44c]
mov dword [ecx], eax
jmp 0x44c6bb
mov eax, dword [ebp - 0x440]
lea edx, [ebp - 0x454]
push edx
push eax
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x458], edi
cmp edi, 0xffffffff
jne 0x44c65d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x438], eax
cmp eax, ebx
jne 0x44c60d
mov edi, dword [ebp - 0x458]
mov dword [ebp - 0x438], ebx
call fcn.0044afe0
mov esi, dword [esi + 8]
lea ecx, [ebp - 0x448]
cmp esi, ebx
jne 0x44c683
mov edx, dword [ebp - 0x44c]
mov dword [edx], 0x13d3f
jmp 0x44c6c1
push edi
push esi
call fcn.005097e0
mov ecx, dword [ebp - 0x438]
cmp ecx, ebx
je 0x44c69e
mov eax, dword [ebp - 0x44c]
mov dword [eax], ecx
jmp 0x44c6bb
cmp eax, edi
je 0x44c6b0
mov ecx, dword [ebp - 0x44c]
mov dword [ecx], 0x13d40
jmp 0x44c6bb
lea ecx, [ebp - 0x448]
call fcn.005096c0
lea ecx, [ebp - 0x448]
mov dword [ebp - method.WindowsFile.virtual_0], vtable.WindowsFile.0
call fcn.005096c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret 8
Function at 0x44fba0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59dd9b
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x601018]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, edx
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
call edi
xor ebx, ebx
test eax, eax
jne 0x44fc08
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
jne 0x44fc1f
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
jmp 0x44fc27
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esi + 0x808]
mov edx, dword [0x61023c]
sbb eax, dword [esi + 0x80c]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
mov edi, dword [esi + 0xc30]
imul edi, dword [esi + 0xc2c]
mov ecx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp dword [esi + 0x814], ebx
je 0x44fd49
mov eax, edi
cdq
cmp ecx, edx
jg 0x44fc84
jl 0x44fc7a
cmp dword [esp + 0x14], eax
jae 0x44fc84
mov dword [esp + 0x20], 1
jmp 0x44fc88
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x44]
mov dword [esp + 0x3c], eax
push esi
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x100
mov dword [esp + 0x150], 1
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov byte [esp + 0x15c], bl
call fcn.00506660
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
push str.Elapsed
push str._s___lld_
lea esi, [esp + 0x4c]
mov dword [esp + 0x1a0], ebx
call fcn.00506600
push edi
push str.interval
push str._s___d_
call fcn.00506600
mov eax, dword [esp + 0x3c]
add esp, 0x1c
push eax
push str.Elapsed_interval
push str._s___d_
call fcn.00506600
mov edx, dword [esp + 0x3c]
add esp, 0xc
mov dword [esp + 0x14c], ebx
push ebx
mov ebx, dword [esp + 0x30]
mov ecx, esi
call fcn.0042c010
mov dword [esp + 0x190], 0xffffffff
call fcn.00506520
mov ecx, dword [esp + 0x18]
mov eax, edi
cdq
cmp ecx, edx
jg 0x44fd5c
jl 0x44fd58
cmp dword [esp + 0x14], eax
jae 0x44fd5c
xor eax, eax
jmp 0x44fd61
mov eax, 1
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
Function at 0x455390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
test esi, esi
je 0x455419
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4553a1
sub eax, edx
test eax, eax
jle 0x4553d0
mov ecx, 1
lea eax, [eax + esi - 1]
sub ecx, esi
lea esp, [esp]
cmp byte [eax], 0x5c
jne 0x4553d0
mov byte [eax], 0
dec eax
lea edx, [ecx + eax]
test edx, edx
jg 0x4553c0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4553d5
sub eax, edx
mov edi, eax
je 0x455419
push esi
call fcn.004f9540
add esp, 4
test eax, eax
jne 0x4553f7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.004f9540
add esp, 4
test eax, eax
je 0x455419
cmp edi, 0x401
jge 0x455419
mov word [edi + esi], 0x5c
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x455430
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x408], edi
mov dword [ebx + 0x1000], 0
call dword [sym.imp.MSVCR100.dll__getpid]
mov dword [ebx + 0x1404], eax
push 0x400
lea eax, [ebx + 0x1408]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test edi, edi
je 0x4555dd
push esi
push 0
push edi
mov ecx, str.GlobalCacheEnable
call fcn.004fd0e0
push 0
push edi
mov ecx, str.GlobalCacheDebug
mov dword [ebx + 0x1808], eax
call fcn.004fd0e0
push 0
push edi
mov ecx, str.GlobalCacheLogLevel
mov dword [ebx + 0x180c], eax
call fcn.004fd0e0
push 0x5bc564
push 0x400
lea esi, [ebx + 0x1814]
push edi
mov ecx, esi
mov edx, str.GlobalCachePath
mov dword [ebx + 0x1810], eax
call fcn.004fd410
call fcn.00455390
test eax, eax
je 0x455507
push esi
push str.unable_to_determinate_GlobalCachePath___s_
lea edi, [ebx + 0x1004]
mov esi, 0x400
mov dword [ebx + 0x1000], 0
call fcn.00401880
mov edi, dword [ebp - 0x408]
add esp, 8
jmp 0x455511
mov dword [ebx + 0x1000], 1
push 3
push edi
mov ecx, str.GlobalCacheRetryCount
call fcn.004fd0e0
push 5
push edi
mov ecx, str.GlobalCacheRetryInterval
mov dword [ebx + 0x1c14], eax
call fcn.004fd0e0
push str.sha1
push 0x400
push edi
lea ecx, [ebp - 0x404]
mov edx, str.GlobalCacheHashType
mov dword [ebx + 0x1c18], eax
call fcn.004fd410
lea ecx, [ebp - 0x404]
push ecx
push str.sha384
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
lea edi, [ebx + 0xc00]
mov esi, 0x400
test eax, eax
jne 0x45557d
push str.sha384
jmp 0x455582
push str.sha1
call fcn.00401880
mov esi, dword [ebp - 0x408]
add esp, 4
push 0
push esi
mov ecx, str.GlobalCacheBufferReset
call fcn.004fd0e0
push 1
push esi
mov ecx, str.GlobalCacheDeleteEmptyFile
mov dword [ebx + 0x1c1c], eax
call fcn.004fd0e0
push 0
push esi
mov ecx, str.GlobalCacheStartup
mov dword [ebx + 0x1c20], eax
call fcn.004fd0e0
push 2
push esi
mov ecx, str.GlobalCacheTempMode
mov dword [ebx + 0x1c24], eax
call fcn.004fd0e0
mov dword [ebx + 0x1c28], eax
pop esi
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 0x1810]
xor ecx, ebp
mov dword [ebx + 0x1c2c], edx
mov eax, ebx
pop edi
call fcn.00596083
mov esp, ebp
pop ebp
ret
Function at 0x468e00
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, eax
mov esi, ecx
test edx, edx
je 0x468eb1
test edi, edi
js 0x468eb1
mov eax, dword [esi + 0x10]
cmp eax, 1
jne 0x468e30
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push edi
push edx
mov edx, dword [eax + 0x2c]
call edx
add dword [esi + 0x14], edi
pop edi
pop esi
ret
cmp eax, 2
jne 0x468e95
mov eax, dword [esi + 0x418]
test eax, eax
je 0x468e76
push eax
push edi
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
test eax, eax
jns 0x468e70
lea eax, [esi + 0x18]
mov esi, dword [esi + 8]
push eax
push str.failed_to_write_to_output_file___s_
mov edi, 0x13afa
call fcn.004526c0
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
ret
add dword [esi + 0x14], eax
pop edi
pop esi
ret
lea ecx, [esi + 0x18]
mov esi, dword [esi + 8]
push ecx
push str.failed_to_write_buffer_to_output_file___s_
mov edi, 0x13afb
call fcn.004526c0
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
ret
mov esi, dword [esi + 8]
push eax
push str.unknown_output_type___d_
mov edi, 0x13afc
call fcn.004526c0
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
ret
mov esi, dword [esi + 8]
push str.invalid_parameters
mov edi, 0x13af9
call fcn.004526c0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
Function at 0x46f7a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59a488
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x601018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor esi, esi
mov dword [esp + 0x1c], edi
cmp eax, esi
je 0x46f7e2
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], esi
mov eax, dword [edi + 8]
mov dword [esp + 0x14], esi
mov esi, dword [eax]
cmp esi, eax
je 0x46f908
cmp byte [esi + 0x2d], 0
mov edi, esi
mov dword [esp + 0x18], edi
jne 0x46f842
mov ecx, dword [esi + 8]
cmp byte [ecx + 0x2d], 0
jne 0x46f822
mov eax, dword [ecx]
cmp byte [eax + 0x2d], 0
jne 0x46f81e
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x2d], 0
je 0x46f814
mov esi, ecx
jmp 0x46f842
mov eax, dword [esi + 4]
cmp byte [eax + 0x2d], 0
jne 0x46f840
jmp 0x46f830
cmp esi, dword [eax + 8]
jne 0x46f840
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], 0
je 0x46f830
mov esi, eax
mov ebx, dword [edi + 0x28]
call fcn.00495680
mov ebx, dword [edi + 0x28]
xor edi, edi
cmp dword [ebx], edi
jne 0x46f8c8
cmp dword [esp + 0x14], 0x20
jge 0x46f8c8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x46f871
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x46f88c
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
jmp 0x46f894
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
sub ecx, dword [ebx + 0x15b8]
mov edx, dword [0x61023c]
sbb eax, dword [ebx + 0x15bc]
push edx
mov edx, dword [0x610238]
push edx
push eax
push ecx
call fcn.00596bf0
cmp edx, edi
jg 0x46f8c8
jl 0x46f8c2
cmp eax, 0x12c
ja 0x46f8c8
inc dword [esp + 0x14]
jmp 0x46f8fa
mov eax, dword [esp + 0x18]
mov ebx, dword [eax + 0x28]
cmp ebx, edi
je 0x46f8e4
mov eax, ebx
call fcn.00494940
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 8]
push ecx
lea edx, [esp + 0x24]
push edx
add eax, 4
push eax
call fcn.00544d60
mov ecx, dword [ebp + 8]
cmp esi, dword [ecx + 8]
jne 0x46f7f7
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x46f915
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4