joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d3c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cf2b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x463140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 2
mov eax, dword [esi + 4]
xor ebx, ebx
test eax, eax
je 0x41d412
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], ebx
mov ecx, dword [esi + 0x60]
lea edi, [esi + 0x50]
cmp ecx, ebx
je 0x41d42f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
cmp ecx, edi
setne dl
movzx edx, dl
push edx
call eax
mov dword [edi + 0x10], ebx
lea edi, [esi + 0x38]
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
je 0x41d450
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
cmp ecx, edi
setne al
movzx eax, al
push eax
call edx
mov dword [edi + 0x10], ebx
lea edi, [esi + 0x20]
mov byte [ebp - 4], bl
mov ecx, dword [edi + 0x10]
cmp ecx, ebx
je 0x41d470
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
cmp ecx, edi
setne dl
movzx edx, dl
push edx
call eax
mov dword [edi + 0x10], ebx
lea edi, [esi + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 3
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea esi, [ebp - 0x10]
mov eax, edi
call fcn.00426140
mov ecx, dword [edi + 4]
push ecx
call fcn.004375fd
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41d520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [eax + 4]
push esi
lea esi, [eax + 4]
test ecx, ecx
jne 0x41d55f
push eax
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
push 0
push 0x41d4b0
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.0043b487
add esp, 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [esi]
xor eax, eax
test edx, edx
setne al
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x41d570
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44cb08
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x463140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ebx, [edi + 4]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
test eax, eax
jne 0x41d650
lea esi, [edi + 0x20]
lea ecx, [ebp + 8]
cmp esi, ecx
je 0x41d5f1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x41d5d0
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
cmp ecx, esi
setne al
movzx eax, al
push eax
call edx
mov dword [esi + 0x10], 0
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x41d5dc
mov dword [esi + 0x10], ecx
jmp 0x41d5f1
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [edx]
jne 0x41d5ea
push esi
jmp 0x41d5ec
push 0
call eax
mov dword [esi + 0x10], eax
push edi
push 0
mov dword [edi], 0
push 0x41d4b0
call fcn.0043b487
add esp, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebx]
xor edx, edx
test ecx, ecx
setne dl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
mov esi, edx
test ecx, ecx
je 0x41d63b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
lea edx, [ebp + 8]
cmp ecx, edx
setne dl
movzx edx, dl
push edx
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x41d671
jmp 0x4c8640
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x41d690
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 4]
test eax, eax
je 0x41d6b4
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
ret

Function at 0x41d6c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 4]
test eax, eax
je 0x41d6f7
mov ecx, dword [esi + 4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 4]
test edx, edx
je 0x41d6f7
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
ret
Function at 0x41d700
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea esi, [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x41d7f1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
jmp 0x41d730
push 0x4ff
push 0xffffffffffffffff
push 0
push esi
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
sub eax, 0
je 0x41d7e0
dec eax
jne 0x41d78a
push 1
push eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
call edi
test eax, eax
je 0x41d730
lea ecx, [ecx]
cmp dword [ebp - 0x18], 0x12
je 0x41d7b1
lea edx, [ebp - 0x1c]
push edx
call ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call edi
test eax, eax
jne 0x41d760
jmp 0x41d730
mov edx, dword [esi]
test edx, edx
je 0x41d7ef
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov dword [esi], 0
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
test edx, edx
je 0x41d7d1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x457030
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], 0
call fcn.0043a2fc
mov ecx, dword [ebp - 4]
add esp, 0xc
test ecx, ecx
je 0x41d8d2
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x41d8b1
mov eax, dword [esi]
jmp 0x41d8b3
mov eax, esi
push ecx
push edx
push 1
push eax
call fcn.0043a49a
mov edx, dword [ebp - 4]
push edx
call fcn.0043a581
add esp, 0x14
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41da90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa00c
call fcn.00445d70
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x41dab8
mov eax, dword [esi]
jmp 0x41daba
mov eax, esi
push ebx
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push ecx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41daef
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, esi
call fcn.0041b560
mov dword [ebp - 0xa00c], 1
lea esp, [esp]
push 0
lea eax, [ebp - 0xa008]
push eax
push 0xa000
lea ecx, [ebp - 0xa004]
push ecx
push ebx
mov dword [ebp - 0xa008], 0xa000
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41db5d
mov edi, dword [ebp - 0xa008]
test edi, edi
je 0x41db67
lea edx, [ebp - 0xa004]
push edx
mov eax, esi
call fcn.004069a3
cmp dword [ebp - 0xa008], 0
ja 0x41db10
jmp 0x41db67
mov dword [ebp - 0xa00c], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa00c]
pop edi
xor ecx, ebp
pop ebx
call fcn.00437608
mov esp, ebp
pop ebp
ret

Function at 0x41dd70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e98b
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40e
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x420], ax
call fcn.00437620
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
test eax, 0xffff0000
jne 0x41de1b
mov ecx, eax
movzx edi, cx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41de3a
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41de3a
lea edx, [ebp - 0x420]
push edx
call fcn.004396d3
add esp, 4
lea ecx, [ebp - 0x420]
mov ebx, eax
push ecx
mov eax, esi
call fcn.00404ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41de60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e956
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40e
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x420], ax
call fcn.00437620
add esp, 0xc
push ebx
push 0x1a
lea edx, [ebp - 0x420]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, section..data
test eax, eax
je 0x41df26
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
test eax, 0xffff0000
jne 0x41df0e
mov ecx, eax
movzx edi, cx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41df81
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41df81
lea edx, [ebp - 0x420]
push edx
call fcn.004396d3
add esp, 4
lea ecx, [ebp - 0x420]
push ecx
jmp 0x41df78
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x456c24
mov dword [ebp - 4], 1
test ecx, 0xffff0000
jne 0x41df66
mov edx, ecx
movzx edi, dx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41df81
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41df81
push 0x456c24
call fcn.004396d3
add esp, 4
push 0x456c24
mov ebx, eax
mov eax, esi
call fcn.00404ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e0e0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e520
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov word [ebp - 0x48], cx
xor edi, edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], edi
call fcn.004141c5
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
mov eax, edx
cmp ecx, 8
jae 0x41e13d
lea eax, [ebp - 0x48]
mov ebx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [eax + ebx*2]
mov ecx, edx
jae 0x41e14d
lea ecx, [ebp - 0x48]
cmp eax, edi
jne 0x41e155
xor eax, eax
jmp 0x41e159
sub eax, ecx
sar eax, 1
mov ebx, eax
lea edi, [ebp - 0x48]
call fcn.0041e9f0
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.004141c5
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov esi, 8
mov eax, edx
cmp ecx, esi
jae 0x41e199
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmp ecx, esi
lea eax, [eax + edi*2]
mov ecx, edx
jae 0x41e1a8
lea ecx, [ebp - 0x2c]
test eax, eax
je 0x41e1b0
sub eax, ecx
sar eax, 1
mov ebx, eax
lea edi, [ebp - 0x2c]
call fcn.0041e9f0
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], ax
xor edi, edi
mov eax, 0x414
mov word [ebp - 0x58], ax
cmp dword [ebp - 0x34], esi
jb 0x41e1ed
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x60], ecx
jmp 0x41e1f3
lea edx, [ebp - 0x48]
mov dword [ebp - 0x60], edx
cmp dword [ebp - 0x18], esi
jb 0x41e200
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
jmp 0x41e206
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0x68]
push edx
mov dword [ebp - 0x64], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x41e251
cmp dword [ebp - 0x18], esi
jb 0x41e22c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004375fd
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x41e24d
mov edx, dword [ebp - 0x48]
push edx
call fcn.004375fd
add esp, 4
xor eax, eax
jmp 0x41e288
cmp dword [ebp - 0x18], esi
jb 0x41e262
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004375fd
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x41e283
mov edx, dword [ebp - 0x48]
push edx
call fcn.004375fd
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e2b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e520
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov word [ebp - 0x48], cx
xor edi, edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], edi
call fcn.004141c5
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
mov eax, edx
cmp ecx, 8
jae 0x41e30d
lea eax, [ebp - 0x48]
mov ebx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [eax + ebx*2]
mov ecx, edx
jae 0x41e31d
lea ecx, [ebp - 0x48]
cmp eax, edi
jne 0x41e325
xor eax, eax
jmp 0x41e329
sub eax, ecx
sar eax, 1
mov ebx, eax
lea edi, [ebp - 0x48]
call fcn.0041e9f0
xor edx, edx
mov eax, esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], dx
call fcn.004141c5
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov esi, 8
mov eax, edx
cmp ecx, esi
jae 0x41e369
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmp ecx, esi
lea eax, [eax + edi*2]
mov ecx, edx
jae 0x41e378
lea ecx, [ebp - 0x2c]
test eax, eax
je 0x41e380
sub eax, ecx
sar eax, 1
mov ebx, eax
lea edi, [ebp - 0x2c]
call fcn.0041e9f0
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov word [ebp - 0x4c], ax
xor edi, edi
mov eax, 0x414
mov word [ebp - 0x58], ax
cmp dword [ebp - 0x34], esi
jb 0x41e3bd
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x60], ecx
jmp 0x41e3c3
lea edx, [ebp - 0x48]
mov dword [ebp - 0x60], edx
cmp dword [ebp - 0x18], esi
jb 0x41e3d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], eax
jmp 0x41e3d6
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0x68]
push edx
mov dword [ebp - 0x64], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x41e421
cmp dword [ebp - 0x18], esi
jb 0x41e3fc
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004375fd
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x41e41d
mov edx, dword [ebp - 0x48]
push edx
call fcn.004375fd
add esp, 4
xor eax, eax
jmp 0x41e458
cmp dword [ebp - 0x18], esi
jb 0x41e432
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004375fd
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x41e453
mov edx, dword [ebp - 0x48]
push edx
call fcn.004375fd
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e576
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
call fcn.004141c5
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, 8
jae 0x41e4f0
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmp ecx, 8
lea eax, [eax + edi*2]
mov ecx, edx
jae 0x41e500
lea ecx, [ebp - 0x2c]
test eax, eax
je 0x41e508
sub eax, ecx
sar eax, 1
mov ebx, eax
lea edi, [ebp - 0x2c]
call fcn.0041e9f0
xor eax, eax
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x48], 3
jb 0x41e542
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x44], ecx
jmp 0x41e548
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x44], edx
lea ecx, [ebp - 0x4c]
mov eax, 0x414
push ecx
mov word [ebp - 0x3c], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, eax
neg edi
sbb edi, edi
cmp dword [ebp - 0x18], 8
jb 0x41e573
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004375fd
add esp, 4
lea eax, [edi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e5a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e956
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40e
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x420], ax
call fcn.00437620
add esp, 0xc
push ebx
push 0x26
lea edx, [ebp - 0x420]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, section..data
test eax, eax
je 0x41e666
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
test eax, 0xffff0000
jne 0x41e64e
mov ecx, eax
movzx edi, cx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41e6c1
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41e6c1
lea edx, [ebp - 0x420]
push edx
call fcn.004396d3
add esp, 4
lea ecx, [ebp - 0x420]
push ecx
jmp 0x41e6b8
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x456c24
mov dword [ebp - 4], 1
test ecx, 0xffff0000
jne 0x41e6a6
mov edx, ecx
movzx edi, dx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41e6c1
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41e6c1
push 0x456c24
call fcn.004396d3
add esp, 4
push 0x456c24
mov ebx, eax
mov eax, esi
call fcn.00404ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e6e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e956
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0x40e
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x420], ax
call fcn.00437620
add esp, 0xc
neg esi
sbb esi, esi
push ebx
and esi, 9
add esi, 0x10
push esi
lea edx, [ebp - 0x420]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, section..data
test eax, eax
je 0x41e7b1
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
test eax, 0xffff0000
jne 0x41e799
mov ecx, eax
movzx esi, cx
push esi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41e80c
push esi
push eax
push edi
call fcn.00404d44
jmp 0x41e80c
lea edx, [ebp - 0x420]
push edx
call fcn.004396d3
add esp, 4
lea ecx, [ebp - 0x420]
push ecx
jmp 0x41e803
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, 0x456c24
mov dword [ebp - 4], 1
jmp 0x4cdb68
mov ebx, eax
mov eax, edi
call fcn.00404ec0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret
Function at 0x41e8b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e956
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x463140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40e
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x420], ax
call fcn.00437620
add esp, 0xc
push ebx
push 0x17
lea edx, [ebp - 0x420]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, section..data
test eax, eax
je 0x41e976
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 4], ebx
test eax, 0xffff0000
jne 0x41e95e
mov ecx, eax
movzx edi, cx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41e9d1
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41e9d1
lea edx, [ebp - 0x420]
push edx
call fcn.004396d3
add esp, 4
lea ecx, [ebp - 0x420]
push ecx
jmp 0x41e9c8
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov ecx, 0x456c24
mov dword [ebp - 4], 1
test ecx, 0xffff0000
jne 0x41e9b6
mov edx, ecx
movzx edi, dx
push edi
call fcn.00404c4f
add esp, 4
cmp eax, ebx
je 0x41e9d1
push edi
push eax
push esi
call fcn.00404d44
jmp 0x41e9d1
push 0x456c24
call fcn.004396d3
add esp, 4
push 0x456c24
mov ebx, eax
mov eax, esi
call fcn.00404ec0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00437608
mov esp, ebp
pop ebp
ret