joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44003e
Capabilities:
Clear file content

Disassembly:
mov eax, 0x4842f0
call fcn.0047e070
sub esp, 0x34
and byte [ebp - 0x10], 0
cmp byte [ebp + 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
je 0x4400f9
test edi, edi
jl 0x440071
jg 0x44006c
cmp dword [ebp + 8], 0
jbe 0x440071
xor eax, eax
inc eax
jmp 0x440073
xor eax, eax
mov byte [esi + 0x17c], al
mov eax, dword [esi + 0x188]
push dword [eax + 0xc0]
lea eax, [esi + 0x178]
push str._s_n_nThis_file_already_exists_on_local_computer.
push eax
call fcn.0042fef9
mov ecx, dword [esi + 0xf0]
add esp, 0xc
call fcn.0042c48e
push eax
lea ecx, [esi + 0x168]
call fcn.0044182c
cmp eax, 0x3f2
jne 0x44022c
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x160]
call fcn.0044eabf
add esp, 0x10
test eax, eax
je 0x4400f5
mov ecx, dword [esi + 0x188]
push dword [ecx + 0xc0]
push eax
push str.Error__d_while_getting_md5_for_local_file__s
push esi
call fcn.0043c628
add esp, 0x10
jmp 0x440276
mov byte [ebp - 0x10], 1
cmp byte [0x4b395c], 0
je 0x440106
or byte [ebp - 0x10], 4
push ebx
lea ecx, [ebp - 0x40]
call fcn.0042bb84
xor ebx, ebx
push 0x40
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.0042bd59
push ebx
lea ecx, [ebp - 0x40]
call fcn.0042bd68
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.0042bd59
test byte [ebp - 0x10], 1
mov dword [ebp - 0x14], ebx
je 0x44015d
mov ebx, dword [ebp + 8]
push edi
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.0044eeef
add esp, 0xc
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
push 0x10
push eax
call fcn.0042bd21
mov dword [ebp - 0x14], edi
mov eax, dword [esi + 0x188]
add eax, 0xc0
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.0042f11a
add esp, 0xc
lea ecx, [ebp - 0x40]
push 1
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0042f61b
push eax
call fcn.0040c2d7
and byte [ebp - 4], 0
add esp, 0xc
lea ecx, [ebp + 0x10]
call fcn.0042eea2
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
lea edi, [eax - 3]
mov eax, dword [ebp - 0x40]
call dword [eax + 0x14]
mov word [eax + 1], di
lea edi, [esi + 0x110]
cmp byte [edi], 0
je 0x4401d6
push 0x14b
push str.S:Ammyy_sources_viewerVrFmBlockR.cpp
lea ecx, [ebp + 8]
call fcn.004282fa
mov ecx, eax
call fcn.00428406
mov al, byte [ebp - 0x10]
mov dword [esi + 0x120], ebx
mov byte [esi + 0x11c], al
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x124], eax
add esi, 0x184
push 1
mov byte [edi], 0x40
mov eax, dword [esi]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
mov edi, dword [eax]
call fcn.0042c48e
mov ecx, dword [esi]
push eax
call dword [edi]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0042bc46
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
cmp eax, 0x3f1
jne 0x440264
push dword [esi + 0x160]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4400f9
mov eax, dword [esi + 0x188]
push dword [eax + 0xc0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__d_while_SetEndOfFile___for_local_file__s
jmp 0x4400e7
cmp eax, 2
jne 0x440276
mov eax, dword [esi + 0x188]
mov byte [eax + 0xc4], 1
xor al, al
jmp 0x44021c
Function at 0x440cf2
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x128], 0x17
jne 0x440d0f
push 1
push 0
push 0
call fcn.0044003e
test al, al
je 0x440d35
pop esi
ret
mov ecx, dword [esi + 0x188]
add ecx, 0xc0
call fcn.0042f61b
push eax
push dword [esi + 0x128]
push str.Error__d_while_opening_remote_file__s
push esi
call fcn.0043c628
add esp, 0x10
mov ecx, esi
pop esi
jmp fcn.0043feb5

Function at 0x441bbd
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x404]
cmp byte [eax + 0xf1c], 0
je 0x441bea
cmp byte [eax + 0xb98], 0
je 0x441bea
cmp dword [eax + 0xc50], 0x300800
jb 0x441bea
mov bl, 1
jmp 0x441bec
xor bl, bl
lea edi, [esi + 0x401]
cmp bl, byte [edi]
je 0x441c73
movzx eax, bl
push eax
push str.OnChangeValues__u__n
call fcn.0043a735
pop ecx
mov byte [edi], bl
test bl, bl
pop ecx
je 0x441c62
cmp byte [0x4b3985], 0
je 0x441c69
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push 0x14
call edi
mov ecx, dword [esi + 0x404]
xor ebx, ebx
and al, 1
push ebx
push eax
push 0x14
call fcn.004350f5
mov ebp, 0x90
push ebp
call edi
mov ecx, dword [esi + 0x404]
and al, 1
push ebx
push eax
push ebp
call fcn.004350f5
inc ebp
push ebp
call edi
mov ecx, dword [esi + 0x404]
and al, 1
push ebx
push eax
push ebp
call fcn.004350f5
pop ebp
jmp 0x441c69
mov ecx, esi
call fcn.00441c77
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.00441cfc
pop edi
pop esi
pop ebx
ret
Function at 0x441cfc
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, 0x48448c
call fcn.0047e070
sub esp, 0x2c
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x4b3cbc
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
call fcn.0042b147
cmp byte [esi + 0x400], bl
mov byte [ebp - 4], 1
je 0x441d7b
cmp byte [esi + 0x401], bl
je 0x441d7b
cmp byte [esi + 0x408], bl
je 0x441d7b
mov eax, dword [0x4b3cd8]
mov byte [ebp - 0x11], 1
cmp eax, ebx
je 0x441d92
cmp eax, dword [esi + 0x404]
je 0x441d6b
push 0x7b
push str.ERROR_u_in_HookKeyboard__
push 0x4b39b0
call fcn.0042b4a1
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0042b15b
jmp 0x441ebd
cmp dword [0x4b3cd8], ebx
mov byte [ebp - 0x11], bl
jne 0x441d92
cmp dword [0x4b3cdc], ebx
je 0x441d6b
push 0x7f
jmp 0x441d59
movzx eax, byte [ebp - 0x11]
push eax
push str.HookKeyboard__X
push 0x4b39b0
call fcn.0042b4b9
add esp, 0xc
cmp byte [ebp - 0x11], bl
je 0x441e41
cmp dword [0x4b3cdc], ebx
jne 0x441e31
cmp dword [0x4b3cd8], ebx
je 0x441de0
lea eax, [ebp - 0x2c]
push str.ERROR1_in_HookKeyboard__
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x2c]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0x200
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
push 0x400000
push 0x441ecc
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp eax, ebx
mov dword [0x4b3cdc], eax
jne 0x441e31
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x38]
push str.Error_d_while_SetWindowsHookEx__
push eax
call fcn.0042a481
add esp, 0xc
lea eax, [ebp - 0x38]
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esi + 0x404]
mov dword [0x4b3cd8], eax
jmp 0x441d6b
mov eax, dword [0x4b3cdc]
cmp eax, ebx
je 0x441d6b
mov ecx, dword [0x4b3cd8]
cmp ecx, dword [esi + 0x404]
jne 0x441d6b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x4b3cdc], ebx
mov dword [0x4b3cd8], ebx
jmp 0x441d6b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x442232
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4844f9
call fcn.0047e070
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042cd68
mov dword [esi], 0x486c04
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
call fcn.0042d52f
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.0042d52f
push fcn.0040d793
push 0x419d9a
lea eax, [esi + 0x44]
push 7
push 0xc
push eax
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.0047e253
lea ebx, [esi + 0x98]
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0042cd68
mov edi, 0x486c2c
mov dword [ebx], edi
lea ebx, [esi + 0xa4]
push 0
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.0042cd68
mov dword [ebx], edi
and byte [esi + 0x13], 0
mov ecx, esi
mov byte [ebp - 4], 5
mov dword [esi], 0x48e8fc
mov dword [esi + 0xc], 0xae
call fcn.00442a36
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x442ef1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042617f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x442f38
push 0x10
lea eax, [ebp - 0x13]
push dword [ebp + 0x18]
mov byte [ebp - 0x14], 0x25
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
push 0x11
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0x11
je 0x442f3c
xor al, al
jmp 0x442f47
mov ecx, dword [ebp + 8]
push esi
call fcn.00425f6a
mov al, 1
pop esi
leave
ret
Function at 0x44464d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4847c4
call fcn.0047e070
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044d200
xor ebx, ebx
lea ecx, [esi + 0x88]
mov dword [ebp - 4], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
call fcn.004583d8
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 1
call fcn.004583d8
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 2
call fcn.00459b38
lea ecx, [esi + 0x18c]
mov byte [ebp - 4], 3
call fcn.00458e9b
lea edi, [esi + 0x240]
mov byte [ebp - 4], 4
lea ecx, [edi + 8]
call fcn.0042d52f
mov dword [edi], 0x48e934
mov dword [edi + 4], ebx
mov byte [esi + 0x450], bl
lea ecx, [esi + 0x454]
mov byte [ebp - 4], 6
call fcn.0042b4d7
push 0x4ab8c8
push str.S:Ammyy_sources_targetTrClient.cpp
push 2
push 0x4b39b0
mov byte [ebp - 4], 7
mov dword [esi], 0x48e910
call fcn.0041dab3
push 0x3bd8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, eax
add esp, 0x14
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov byte [ebp - 4], 8
je 0x44471a
call fcn.00430902
jmp 0x44471c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xa0], bl
mov byte [esi + 0xbc], bl
mov byte [esi + 0xbd], bl
mov dword [esi + 0xc8], ebx
mov byte [esi + 0xc5], bl
mov word [esi + 0x84], bx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0xc4], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44598a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, 0x484a7c
call fcn.0047e070
sub esp, 0x24
mov eax, dword [ebp + 0x10]
push esi
lea ecx, [ebp - 0x30]
lea eax, [eax + eax + 1]
push eax
call fcn.0042bbba
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0042c48e
mov edx, dword [ebp + 0xc]
mov esi, eax
mov cl, byte [edx]
inc edx
cmp cl, 0xa
jne 0x4459c5
mov byte [eax], 0xd
inc eax
mov byte [eax], cl
inc eax
test cl, cl
jne 0x4459b9
push 0xffffffffffffffff
lea eax, [ebp + 0x10]
push esi
push eax
call fcn.0040c3bb
add esp, 0xc
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x445a0a
lea eax, [ebp - 0x18]
push str.Failed_to_open_clipboard
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x445a38
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x18]
push str.Failed_to_empty_clipboard
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
push edi
lea ecx, [ebp + 0x10]
call fcn.0042f5f9
lea edi, [eax + eax + 2]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x445a85
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
lea ecx, [ebp + 0x10]
mov ebx, eax
call fcn.0042f61b
push eax
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
pop edi
jne 0x445aae
lea eax, [ebp - 0x18]
push str.Failed_to_close_clipboard
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
and byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0042eea2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0042bc46
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x445b84
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x484a90
call fcn.0047e070
sub esp, 0x18
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov ecx, dword [edi + 0x550]
cmp eax, ecx
je 0x445c50
lea eax, [edi + 0x60d]
cmp byte [eax], 0
jne 0x445bbc
mov byte [eax], 1
jmp 0x445c50
cmp dword [edi + 0x558], 0
je 0x445c50
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x445c50
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x445bea
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x445c50
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
lea ecx, [ebp - 0x24]
mov ebx, eax
call fcn.0042bb84
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push 1
push eax
push ebx
call fcn.0040c2d7
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x24]
call fcn.0042c48e
mov esi, eax
mov edx, eax
pop ebx
mov cl, byte [esi]
inc esi
cmp cl, 0xd
je 0x445c29
mov byte [edx], cl
inc edx
test cl, cl
jne 0x445c29
mov ecx, dword [edi + 0x54c]
push eax
call fcn.00444ac4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0042bc46
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4488b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x40]
push ebx
push esi
mov esi, dword [edx + 4]
mov ebx, dword [edx]
push edi
mov edi, dword [ecx + 0x48]
imul eax, ebx
imul edi, esi
add eax, edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 0xc]
add eax, dword [ecx + 8]
sub edx, esi
mov esi, dword [ecx + 0x44]
sub edi, ebx
sub esi, edi
test edx, edx
jle 0x448943
shl esi, 2
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
test edi, edi
jle 0x44893b
mov dword [ebp + 8], edi
mov edx, dword [eax]
add eax, 4
mov esi, edx
mov ebx, edx
shr esi, 0xd
and esi, 0xff
and ebx, 0xff
xor esi, ebx
mov esi, dword [ecx + esi*4 + 0x8a8]
jmp 0x448927
cmp dword [esi + 8], edx
je 0x44894a
mov esi, dword [esi]
test esi, esi
jne 0x448920
or dl, 0xff
mov esi, dword [ebp + 0xc]
inc dword [ebp + 0xc]
dec dword [ebp + 8]
mov byte [esi], dl
jne 0x4488fd
add eax, dword [ebp - 8]
dec dword [ebp - 4]
jne 0x4488f6
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dl, byte [esi + 4]
jmp 0x44892e
Function at 0x44b499
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x484cf2
call fcn.0047e070
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.0042cd68
mov dword [esi], 0x486c04
push fcn.0040d793
push 0x419d9a
push 5
lea eax, [esi + 0x30]
push 0xc
push eax
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.0047e253
lea edi, [esi + 0x6c]
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0042cd68
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x486c30
mov dword [esi], 0x48e968
mov byte [esi + 0x10], bl
mov dword [esi + 0xc], 0xad
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44d8a8
Capabilities:
Move file

Disassembly:
mov eax, 0x484eec
call fcn.0047e070
sub esp, 0x4c
push esi
mov esi, ecx
cmp byte [esi + 0x48], 0
jne 0x44d8dc
lea eax, [ebp - 0x40]
push str.FileManager_is_forbidden
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x40]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
mov al, byte [0x4b393e]
push ebx
push edi
push eax
lea ecx, [ebp - 0x34]
call fcn.0041d8c3
mov ecx, dword [esi + 0xc]
xor edi, edi
mov dword [ebp - 0x10], edi
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push 2
push edx
mov dword [ebp - 4], edi
call dword [eax + 4]
movzx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
call fcn.0042bbba
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
mov ebx, dword [eax]
movzx eax, word [ebp - 0x10]
push eax
call fcn.0042c48e
mov ecx, dword [esi + 0xc]
push eax
call dword [ebx + 4]
movzx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
call fcn.0042c492
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x58]
push eax
call fcn.0042bfd4
or ebx, 0xffffffff
mov ecx, eax
push ebx
mov byte [ebp - 4], 2
call fcn.0042f61b
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040c3bb
add esp, 0xc
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.0042d82b
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0044d682
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x58]
push eax
call fcn.0042bfd4
push ebx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0042f61b
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040c3bb
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.0042f11a
add esp, 0x18
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.0042eea2
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
call fcn.0042d82b
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x58]
push eax
call fcn.0042bfd4
push ebx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0042f61b
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c3bb
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xb
call fcn.0042f11a
add esp, 0x18
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.0042eea2
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xd
call fcn.0042d82b
lea ecx, [ebp - 0x18]
call fcn.0042f61b
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042f61b
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
jne 0x44da3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [ebp - 0x58]
call fcn.0042bc62
push 0x46
lea ecx, [ebp - 0x58]
call fcn.0042bd59
push edi
lea ecx, [ebp - 0x58]
call fcn.0042bd77
mov eax, dword [esi + 0xc]
push 1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x58]
mov edi, dword [eax]
call fcn.0042c4a3
mov ecx, dword [esi + 0xc]
push eax
call dword [edi]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.0042eea2
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.0042eea2
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042eea2
and byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0042bc46
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0041d8e0
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44dab7
Capabilities:
Create directory

Disassembly:
mov eax, 0x484f18
call fcn.0047e070
sub esp, 0x34
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x48], bl
jne 0x44daed
lea eax, [ebp - 0x28]
push str.FileManager_is_forbidden
push eax
call fcn.0042a481
pop ecx
lea eax, [ebp - 0x28]
pop ecx
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
mov al, byte [0x4b393e]
push edi
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041d8c3
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x10], ebx
lea edx, [ebp - 0x10]
push 2
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], ebx
call dword [eax + 4]
movzx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0x40]
call fcn.0042bbba
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov edi, dword [eax]
movzx eax, word [ebp - 0x10]
push eax
call fcn.0042c48e
mov ecx, dword [esi + 0xc]
push eax
call dword [edi + 4]
movzx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0x40]
call fcn.0042c492
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x40]
push eax
call fcn.0042bf71
movzx ecx, word [ebp - 0x10]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0042f61b
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040c3bb
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.0042d82b
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0044d682
push ebx
lea ecx, [ebp - 0x14]
call fcn.0042f61b
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
je 0x44db9f
xor edi, edi
jmp 0x44dba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [ebp - 0x40]
call fcn.0042bc62
push 0x46
lea ecx, [ebp - 0x40]
call fcn.0042bd59
push edi
lea ecx, [ebp - 0x40]
call fcn.0042bd77
mov eax, dword [esi + 0xc]
push 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
mov edi, dword [eax]
call fcn.0042c4a3
mov ecx, dword [esi + 0xc]
push eax
call dword [edi]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042eea2
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0042bc46
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041d8e0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44e7bb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x44e7f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.Error__d_GetFileSizeEx__
push eax
call fcn.0042a481
add esp, 0xc
lea eax, [ebp - 0x14]
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
leave
ret

Function at 0x44e800
Capabilities:
Check if file exists
Get file size

Disassembly:
mov eax, 0x48501c
call fcn.0047e070
sub esp, 0x1c
push ebx
push esi
push 0
push 0x80
xor esi, esi
push 3
push 0
inc esi
push 0
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44e87f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x44e846
or edx, ebx
mov eax, edx
jmp 0x44e8f1
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0042d8e3
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0042f61b
push eax
call esi
push eax
lea eax, [ebp - 0x28]
push str.Error__d_while_open_file__s
push eax
call fcn.0042a481
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x44e8ca
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0042d8e3
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.0042f61b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x28]
push str.Error__d_in_GetFileSizeEx___for__s
push eax
call fcn.0042a481
add esp, 0x10
lea eax, [ebp - 0x28]
push 0x4924b4
push eax
call sub.MSVCRT.dll__CxxThrowException
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x44e8eb
push 0x38
push str.S:Ammyy_sources_targetTrFmFileSys.cpp
lea ecx, [ebp - 0x1c]
call fcn.004282fa
mov ecx, eax
call fcn.00428406
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret