joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b09
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x194]
mov esi, ecx
push eax
mov dword [ebp - 4], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi + 8]
add esi, 8
lea ecx, [ebp - 0x194]
push ecx
push str.Username
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [ebp + 8]
cmp eax, 3
jne 0x405b55
mov eax, dword [esi]
push str.ActiveX
jmp 0x405b7f
cmp eax, 1
jne 0x405b63
mov eax, dword [esi]
push str..NET_1.
jmp 0x405b7f
cmp eax, 2
jne 0x405b71
mov eax, dword [esi]
push str..NET_2.0
jmp 0x405b7f
cmp eax, 0x108
jne 0x405b89
mov eax, dword [esi]
push str..NET_2.0___x64
push str.Component
mov ecx, esi
call dword [eax + 0x28]
pop esi
leave
ret 4

Function at 0x409b6a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x46a278
call fcn.0045d3c0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0043bdd0
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00407b7b
lea ecx, [esi + 0x30]
mov dword [esi + 0x2c], edi
call fcn.00407ba7
lea ecx, [esi + 0x60]
call fcn.00416ed0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov word [esi + 0x8c], di
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi], vtable.ZipWalkEntry.0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x409cef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov esi, ecx
push dword [ebp + 8]
push 0x51
call fcn.0041b540
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x409d84
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x409d7b
mov eax, dword [esi + 0x28]
test eax, eax
je 0x409d7b
and dword [ebp + 0xc], 0
lea edx, [ebp + 0xc]
push 0
push edx
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x2c]
je 0x409d7b
test edi, edi
je 0x409d7b
mov eax, dword [edi]
push str.Failed_to_write_data_to_file
mov ecx, edi
call dword [eax + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0041a7a0
push eax
push str.filename
mov ecx, edi
call fcn.0043f680
push dword [esi + 0x2c]
mov eax, dword [edi]
mov ecx, edi
push str.data_size
call dword [eax + 0x2c]
push dword [ebp + 0xc]
mov eax, dword [edi]
mov ecx, edi
push str.bytes_written
call dword [eax + 0x2c]
push edi
push ebx
call fcn.0043cf40
pop ecx
pop ecx
cmp dword [ebp + 0x10], 0
je 0x409da2
and byte [ebp + 0xb], 0
lea eax, [ebp + 0xb]
push eax
mov ecx, esi
call fcn.00409ceb
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004225b0
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40b07e
Capabilities:
Delete file

Disassembly:
mov eax, 0x46a444
call fcn.0045d3c0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x30], bl
je 0x40b187
lea ecx, [ebp - 0x40]
call fcn.00416ed0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push edi
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040a436
cmp al, bl
jne 0x40b0d6
mov eax, dword [edi]
push str.Failed_to_get_temp_file_for_AES_encryption
mov ecx, edi
call dword [eax + 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004171c0
jmp 0x40b1e7
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
lea edi, [esi + 0x5c]
push ebx
call fcn.00422700
push eax
mov ecx, edi
call fcn.00422700
push eax
lea ecx, [esi + 0xc]
call fcn.00422700
push eax
push dword [esi + 8]
push dword [esi + 4]
call fcn.0043e6c0
add esp, 0x1c
cmp al, bl
jne 0x40b128
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.00422700
push eax
call fcn.0041d1a0
mov eax, dword [esi]
pop ecx
pop ecx
push str.Failed_to_AES_encrypt_source_file_data
mov ecx, esi
jmp 0x40b0c2
cmp byte [esi + 0x5b], bl
je 0x40b13b
mov ecx, edi
call fcn.00422700
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x40]
mov byte [esi + 0x5b], 1
call fcn.00422700
push eax
mov ecx, edi
call fcn.00417e70
cmp byte [esi + 0x98], bl
lea edi, [esi + 0x98]
lea ecx, [esi + 0x80]
jne 0x40b16d
call fcn.004227e0
mov byte [edi], 1
jmp 0x40b172
call fcn.004226d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
mov byte [esi + 0x30], 1
call fcn.004171c0
jmp 0x40b235
lea ecx, [ebp - 0x24]
call fcn.00422840
push dword [ebp + 8]
lea edi, [esi + 0x80]
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
mov dword [ebp - 4], 1
call fcn.004226e0
push eax
mov ecx, edi
call fcn.00422700
push eax
lea ecx, [esi + 0xc]
call fcn.00422700
push eax
push dword [esi + 8]
push dword [esi + 4]
call fcn.0043e720
add esp, 0x1c
cmp al, bl
jne 0x40b1eb
mov ecx, dword [ebp + 8]
push str.Failed_to_AES_encrypt_source_data
mov eax, dword [ecx]
call dword [eax + 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00422f50
xor al, al
jmp 0x40b237
cmp byte [esi + 0x98], bl
mov ecx, edi
jne 0x40b1fc
call fcn.004227e0
jmp 0x40b201
call fcn.004226d0
lea ecx, [ebp - 0x24]
call fcn.004226e0
push eax
lea ecx, [ebp - 0x24]
call fcn.00422700
push eax
mov ecx, edi
call fcn.00423100
lea ecx, [ebp - 0x24]
call fcn.004227e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov byte [esi + 0x98], 1
call fcn.00422f50
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40b703
Capabilities:
Delete file

Disassembly:
mov eax, 0x46a494
call fcn.0045d3c0
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor bl, bl
push edi
and dword [esi + 0xc0], 0
cmp byte [esi + 0x5a], bl
je 0x40b72b
cmp dword [esi + 0x34], 4
jne 0x40b72b
inc bl
mov edi, dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0040a1c7
test al, al
je 0x40b77e
push edi
mov ecx, esi
call fcn.0040a478
test al, al
je 0x40b77e
mov al, byte [esi + 0x58]
test al, al
je 0x40b7ad
cmp byte [esi + 0x59], 0
je 0x40b792
test bl, bl
je 0x40b785
lea ecx, [esi + 0x80]
call fcn.004226e0
test eax, eax
jbe 0x40b7b3
push edi
mov ecx, esi
call fcn.0040a8fd
test al, al
jne 0x40b7b3
mov eax, dword [edi]
push str.Failed_to_inflate_WinZip_AES_encrypted_data_to_temp
mov ecx, edi
call dword [eax + 0x10]
xor al, al
jmp 0x40b816
push edi
mov ecx, esi
push dword [ebp + 8]
call fcn.0040b53e
jmp 0x40b7d9
test al, al
je 0x40b7ad
cmp byte [esi + 0x59], 0
jne 0x40b7a9
push edi
mov ecx, esi
push dword [ebp + 8]
call fcn.0040b69f
jmp 0x40b7d9
test al, al
jne 0x40b7ce
cmp byte [esi + 0x59], 0
je 0x40b7ce
lea eax, [esi + 0xb8]
push edi
push eax
lea eax, [esi + 0xb0]
push eax
mov ecx, esi
push dword [ebp + 8]
call fcn.0040b607
jmp 0x40b7d9
push edi
mov ecx, esi
push dword [ebp + 8]
call fcn.0040b6b3
cmp byte [esi + 0x5b], 0
mov bl, al
je 0x40b814
lea ecx, [esi + 0x5c]
call fcn.00422700
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b814
lea ecx, [ebp - 0x28]
call fcn.00416ed0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00418200
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004171c0
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x40e4be
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
push dword [esi + 4]
call fcn.0040e4ff
mov dword [esi + 4], eax
and eax, 0xff
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
mov byte [esp + 0x10], al
push dword [esp + 0x10]
push dword [esi + 0xc]
call fcn.0040e4ff
add esp, 0x10
mov dword [esi + 0xc], eax
pop esi
ret 4
Function at 0x41418d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x1c]
mov eax, dword [esi + 0x64]
mov ebx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x6c]
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 4], ebx
jne 0x4141b7
test eax, eax
jne 0x4141c1
test ecx, ecx
jne 0x4141c1
mov ebx, edi
jmp 0x41422d
cmp ebx, 0xffffffff
jne 0x4141c1
push 0xfffffffffffffffe
pop ebx
jmp 0x41422d
mov ecx, dword [esi + 0x1c]
lea ecx, [edi + ecx - 0x106]
cmp eax, ecx
jb 0x41422d
mov eax, dword [esi + 0x28]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0045dce0
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x4141f2
mov eax, dword [esi + 0x30]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x414211
mov ebx, dword [ebp - 4]
add ebx, edi
mov ecx, dword [esi + 4]
call fcn.00410131
test eax, eax
je 0x41428f
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 4]
add eax, dword [esi + 0x64]
push ebx
add eax, dword [esi + 0x28]
push eax
call fcn.0041037c
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
cmp ebx, 3
jb 0x414277
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x28]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x41428f
mov ecx, dword [esi + 4]
call fcn.00410131
test eax, eax
jne 0x414199
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4165e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a7a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x38]
mov esi, ecx
mov ecx, edi
call fcn.00416380
lea ecx, [esp + 8]
call fcn.00416ed0
mov eax, dword [esp + 0x34]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x30], 0
call fcn.00416a20
lea ecx, [esp + 8]
call fcn.004161a0
push 0x3d
lea ecx, [esp + 0xc]
call fcn.004163f0
lea ecx, [esp + 8]
call fcn.00422700
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.0045da70
mov esi, eax
add esp, 8
test esi, esi
jne 0x41667c
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004171c0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
lea ecx, [esp + 8]
call fcn.004226f0
add esi, eax
push 0x3b
push esi
call fcn.0045d9b0
add esp, 8
test eax, eax
jne 0x4166a0
push esi
mov ecx, edi
call fcn.00416a20
jmp 0x4166ab
sub eax, esi
mov ecx, edi
push eax
push esi
call fcn.00416c60
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004171c0
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x416910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a7d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
call fcn.00416ed0
lea ecx, [esp + 0x30]
mov dword [esp + 0x54], 0
call fcn.00416ed0
mov edi, dword [esi + 0xc]
mov byte [esp + 0x54], 1
xor bl, bl
push 0x25
push edi
call fcn.0045d9b0
mov esi, eax
add esp, 8
test esi, esi
je 0x4169ca
inc esi
push 0x25
push esi
call fcn.0045d9b0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4169ca
lea ecx, [esp + 0x30]
mov bl, 1
call fcn.00416380
mov eax, ebp
lea ecx, [esp + 0x30]
sub eax, esi
push eax
push esi
call fcn.00416c60
dec esi
cmp esi, edi
jbe 0x4169a5
sub esi, edi
lea ecx, [esp + 0x14]
push esi
push edi
call fcn.00416c60
lea ecx, [esp + 0x30]
lea edi, [ebp + 1]
call fcn.00422700
push eax
call fcn.0045e119
add esp, 4
test eax, eax
je 0x416956
push eax
lea ecx, [esp + 0x18]
call fcn.00416a20
jmp 0x416956
push edi
lea ecx, [esp + 0x18]
call fcn.00416a20
pop edi
pop esi
pop ebp
test bl, bl
pop ebx
je 0x4169ea
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
call fcn.00417f00
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 0
call fcn.004171c0
lea ecx, [esp + 4]
mov dword [esp + 0x44], 0xffffffff
call fcn.004171c0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x417a60
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46a936
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push esi
mov esi, ecx
push edi
cmp byte [esi + 8], 0xaa
je 0x417a8f
push 0
call fcn.00422810
add esp, 4
mov ecx, esi
call fcn.004226f0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00430e20
lea ecx, [esp + 8]
mov dword [esp + 0xc8], 0
call fcn.00422840
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0xd0]
lea eax, [esp + 8]
mov byte [esp + 0xc8], 1
push eax
push edi
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.0043bda0
mov ecx, esi
call fcn.00416380
lea ecx, [esp + 8]
call fcn.004226e0
push eax
lea ecx, [esp + 0xc]
call fcn.00422700
push eax
mov ecx, esi
call fcn.00416c60
lea ecx, [esp + 8]
mov byte [esp + 0xc8], 0
call fcn.00422f50
lea ecx, [esp + 0x20]
mov dword [esp + 0xc8], 0xffffffff
call fcn.00430e70
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xc4
ret 4

Function at 0x417b40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46a956
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push esi
mov esi, ecx
push edi
cmp byte [esi + 8], 0xaa
je 0x417b6f
push 0
call fcn.00422810
add esp, 4
mov ecx, esi
call fcn.004226f0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.00430e20
lea ecx, [esp + 8]
mov dword [esp + 0xc8], 0
call fcn.00422840
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0xd0]
lea eax, [esp + 8]
mov byte [esp + 0xc8], 1
push eax
push edi
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.0043bd70
mov ecx, esi
call fcn.00416380
lea ecx, [esp + 8]
call fcn.004226e0
push eax
lea ecx, [esp + 0xc]
call fcn.00422700
push eax
mov ecx, esi
call fcn.00416c60
lea ecx, [esp + 8]
mov byte [esp + 0xc8], 0
call fcn.00422f50
lea ecx, [esp + 0x20]
mov dword [esp + 0xc8], 0xffffffff
call fcn.00430e70
mov ecx, dword [esp + 0xc0]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xc4
ret 4

Function at 0x4189c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46a9d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.00416ed0
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x30], 0
mov ecx, edi
call fcn.00419ea0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
push ecx
lea ecx, [esi + 0x138]
call fcn.0042a7a0
mov bl, al
test bl, bl
je 0x418a25
lea ecx, [esp + 0xc]
call fcn.00422700
push eax
mov ecx, edi
call fcn.00419f90
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004171c0
mov ecx, dword [esp + 0x28]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x419a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
test ebp, ebp
mov esi, ecx
je 0x419aa4
mov dword [ebp], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x419ab4
pop edi
pop esi
xor al, al
pop ebp
ret 0x10
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x419ac4
pop edi
pop esi
xor al, al
pop ebp
ret 0x10
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
jne 0x419ad4
pop edi
pop esi
mov al, 1
pop ebp
ret 0x10
lea edx, [esp + 0x14]
push 0
push edx
push ecx
push edi
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x419b14
mov al, byte [esi + 0x14]
test al, al
je 0x419b05
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0xffffffff
pop edi
pop esi
mov al, 1
pop ebp
ret 0x10
push ebx
push eax
push edi
lea ecx, [esi + 4]
call fcn.004436c0
mov ecx, dword [esi + 0x10]
mov bl, 1
test ecx, ecx
je 0x419b58
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x24], 0
call fcn.004225b0
mov al, byte [esp + 0x1c]
test al, al
je 0x419b58
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x419b56
mov edx, dword [ecx]
push str.Aborted_by_application
call dword [edx + 0x14]
xor bl, bl
mov eax, dword [esp + 0x18]
test ebp, ebp
je 0x419b63
mov dword [ebp], eax
mov ecx, dword [esi + 0xc]
add ecx, eax
mov al, bl
pop ebx
mov dword [esi + 0xc], ecx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x41ae70
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46ad6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3ac
lea ecx, [esp]
call fcn.004472d0
lea ecx, [esp]
mov dword [esp + 0x3b4], 0
call fcn.00447320
test al, al
je 0x41aed5
lea eax, [esp + 0x98]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x3c0]
call fcn.00419f30
jmp 0x41af29
lea edx, [esp + 0x1a0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x41af15
lea eax, [esp + 0x98]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x3c0]
call fcn.00419f30
jmp 0x41af29
mov ecx, dword [esp + 0x3bc]
lea edx, [esp + 0x1a0]
push edx
call fcn.0041a050
lea ecx, [esp]
mov dword [esp + 0x3b4], 0xffffffff
call fcn.00447310
mov ecx, dword [esp + 0x3ac]
mov dword fs:[0], ecx
add esp, 0x3b8
ret
Function at 0x41af60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46ad8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3ac
lea ecx, [esp + 0x108]
call fcn.004472d0
lea ecx, [esp + 0x108]
mov dword [esp + 0x3b4], 0
call fcn.00447320
test al, al
je 0x41afc5
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x3c0]
call fcn.00419f30
jmp 0x41b01b
lea edx, [esp + 0x1a0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41b007
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x41aff4
mov byte [esp], al
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0x3c0]
call fcn.00419f30
jmp 0x41b01b
mov ecx, dword [esp + 0x3bc]
lea edx, [esp + 0x1a0]
push edx
call fcn.0041a050
lea ecx, [esp + 0x108]
mov dword [esp + 0x3b4], 0xffffffff
call fcn.00447310
mov ecx, dword [esp + 0x3ac]
mov dword fs:[0], ecx
add esp, 0x3b8
ret

Function at 0x41b140
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x46adec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x174
lea ecx, [esp + 0x7c]
call fcn.00419d20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x17c], 0
call fcn.00419d20
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x7c]
push eax
mov byte [esp + 0x180], 1
call fcn.0041a9d0
mov ecx, dword [esp + 0x188]
push ecx
lea ecx, [esp + 0x20]
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x84]
call fcn.0041abb0
push 0x5c
push 0x2f
lea ecx, [esp + 0x24]
call fcn.0041abb0
lea ecx, [esp + 0xdc]
call fcn.004472d0
lea ecx, [esp + 0xdc]
mov byte [esp + 0x17c], 2
call fcn.00447320
test al, al
lea ecx, [esp + 0x1c]
je 0x41b202
call fcn.0041a4b0
push eax
lea ecx, [esp + 0x80]
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x41b21b
call fcn.0041a130
push eax
lea ecx, [esp + 0x80]
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
and eax, 0xff
test eax, eax
jne 0x41b2d0
push esi
mov esi, dword [esp + 0x190]
test esi, esi
je 0x41b27c
push edi
lea ecx, [esp + 8]
call fcn.00416ed0
lea ecx, [esp + 8]
mov byte [esp + 0x184], 3
call fcn.00418200
mov edi, dword [esi]
lea ecx, [esp + 8]
call fcn.00422700
push eax
push str.errorMsg
mov ecx, esi
call dword [edi + 0x28]
lea ecx, [esp + 8]
mov byte [esp + 0x184], 2
call fcn.004171c0
pop edi
lea ecx, [esp + 0xe0]
mov byte [esp + 0x180], 1
call fcn.00447310
lea ecx, [esp + 0x20]
mov byte [esp + 0x180], 0
call fcn.00419de0
lea ecx, [esp + 0x80]
mov dword [esp + 0x180], 0xffffffff
call fcn.00419de0
xor al, al
pop esi
mov ecx, dword [esp + 0x174]
mov dword fs:[0], ecx
add esp, 0x180
ret
lea ecx, [esp + 0xdc]
mov byte [esp + 0x17c], 1
call fcn.00447310
lea ecx, [esp + 0x1c]
mov byte [esp + 0x17c], 0
call fcn.00419de0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x17c], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x174]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x180
ret
Function at 0x41b320
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x46ae21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
lea ecx, [esp + 4]
call fcn.00419d20
lea ecx, [esp + 0x64]
mov dword [esp + 0x164], 0
call fcn.00419d20
mov eax, dword [esp + 0x16c]
lea ecx, [esp + 4]
push eax
mov byte [esp + 0x168], 1
call fcn.0041a9d0
mov ecx, dword [esp + 0x170]
push ecx
lea ecx, [esp + 0x68]
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.0041abb0
push 0x5c
push 0x2f
lea ecx, [esp + 0x6c]
call fcn.0041abb0
lea ecx, [esp + 0xc4]
call fcn.004472d0
lea ecx, [esp + 0xc4]
mov byte [esp + 0x164], 2
call fcn.00447320
test al, al
je 0x41b3ec
mov cl, byte [esp + 0x174]
xor edx, edx
test cl, cl
setne dl
push edx
lea ecx, [esp + 0x68]
call fcn.0041a4b0
push eax
lea ecx, [esp + 0xc]
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x41b415
mov dl, byte [esp + 0x174]
xor eax, eax
test dl, dl
setne al
push eax
lea ecx, [esp + 0x68]
call fcn.0041a130
push eax
lea ecx, [esp + 0xc]
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0x164], 1
setne bl
call fcn.00447310
lea ecx, [esp + 0x64]
mov byte [esp + 0x164], 0
call fcn.00419de0
lea ecx, [esp + 4]
mov dword [esp + 0x164], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x15c]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret

Function at 0x41b470
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x46ae46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
lea ecx, [esp + 4]
call fcn.00419d20
mov eax, dword [esp + 0x10c]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x108], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.0041abb0
lea ecx, [esp + 0x64]
call fcn.004472d0
lea ecx, [esp + 0x64]
mov byte [esp + 0x104], 1
call fcn.00447320
test al, al
lea ecx, [esp + 4]
je 0x41b4ee
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41b4fa
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x104], 0
setne bl
call fcn.00447310
lea ecx, [esp + 4]
mov dword [esp + 0x104], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0xfc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret