joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403dc8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
add eax, eax
push eax
xor edi, edi
call fcn.004637f6
mov ebx, dword [ebp + 8]
test ebx, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x403e1b
push ebx
call fcn.0044d870
lea eax, [eax + eax + 2]
push eax
call fcn.004637f6
push ebx
mov edi, eax
xor esi, esi
call fcn.0044d870
add esp, 0xc
movsx ax, byte [esi + ebx]
mov word [edi + esi*2], ax
push ebx
inc esi
call fcn.0044d870
cmp esi, eax
pop ecx
jbe 0x403e06
push dword [ebp + 0x14]
lea ecx, [ebp - 0x58]
call fcn.00403846
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004047e4
pop ecx
pop ecx
xor esi, esi
push 0
inc esi
push esi
lea ecx, [ebp - 0x58]
call fcn.0040155a
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x403e4f
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp + 0x10], eax
je 0x403e6d
push edi
call fcn.004637fb
pop ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x58]
call fcn.00402bb5
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004046ef
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x58]
call fcn.0040287e
xor eax, eax
cmp dword [ebp - 8], 0x10
mov ecx, dword [ebp - 0x1c]
jae 0x403e9f
lea ecx, [ebp - 0x1c]
mov cl, byte [ecx + eax]
mov edx, dword [ebp + 0xc]
mov byte [eax + edx], cl
inc eax
cmp eax, dword [ebp - 0xc]
jbe 0x403e93
push dword [ebp - 4]
call fcn.004637fb
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x20]
call fcn.0040155a
push ebx
push esi
lea ecx, [ebp - 0x3c]
call fcn.0040155a
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403f0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], 0x10
mov eax, dword [ebp + 0xc]
xor ecx, dword [eax]
mov dword [ebp + 8], ecx
call fcn.00403ed3
add dword [ebp + 0xc], 4
xor eax, esi
dec dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, eax
jne 0x403f28
mov eax, dword [edx + 0x40]
xor eax, ecx
mov ecx, dword [edx + 0x44]
xor ecx, esi
mov dword [edi], ecx
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x403f58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
push esi
push edi
mov edi, dword [eax]
lea esi, [edx + 0x44]
mov dword [ebp + 0xc], 0x10
xor ecx, dword [esi]
mov dword [ebp + 8], ecx
call fcn.00403ed3
xor eax, edi
mov edi, dword [ebp + 8]
sub esi, 4
dec dword [ebp + 0xc]
mov ecx, eax
jne 0x403f75
mov eax, dword [edx + 4]
xor eax, ecx
mov ecx, dword [edx]
xor ecx, edi
mov dword [ebx], ecx
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x403fa3
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov eax, 0x4834c0
lea ecx, [edi + 0x48]
pop ebx
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, ebx
add ecx, ebx
dec edx
jne 0x403fbf
cmp eax, 0x4844c0
jl 0x403fba
mov edx, 0x483478
xor ecx, ecx
mov eax, edi
sub edx, edi
mov dword [ebp - 4], 0x12
xor esi, esi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
movzx ebx, byte [ecx + ebx]
shl esi, 8
or esi, ebx
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x403ffc
xor ecx, ecx
dec dword [ebp - 8]
jne 0x403fe8
mov ebx, dword [edx + eax]
xor ebx, esi
mov dword [eax], ebx
push 4
pop ebx
add eax, ebx
dec dword [ebp - 4]
jne 0x403fe3
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.00403f0b
mov eax, dword [ebp - 4]
mov dword [edi + esi*4], eax
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [edi + esi*4 + 4], eax
inc esi
inc esi
cmp esi, 0x12
jl 0x40401a
lea esi, [edi + 0x4c]
mov dword [ebp - 0xc], ebx
mov ebx, 0x80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
call fcn.00403f0b
mov eax, dword [ebp - 4]
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esp, 0xc
add esi, 8
dec ebx
jne 0x40404a
dec dword [ebp - 0xc]
jne 0x404045
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405565
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x484958
push SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4055e9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
mov edi, 0x484940
push edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4055d9
push ebx
mov ebx, dword [ebp + 8]
push dword [ebp - 8]
mov ecx, ebx
call fcn.0040546f
cmp dword [ebx + 0x18], 0x10
jb 0x4055c5
mov ebx, dword [ebx + 4]
jmp 0x4055c8
add ebx, 4
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0
push edi
push dword [ebp - 4]
call esi
xor ebx, ebx
cmp dword [ebp - 4], ebx
pop edi
pop esi
je 0x4055e9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4
Function at 0x4055ee
Capabilities:
Delete file

Disassembly:
mov eax, 0x47d0ec
call fcn.0044d428
sub esp, 0x140
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00476bf9
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
sub eax, 0x191
push 4
pop ecx
mov dword [ebp - 0x10], ecx
je 0x40562e
dec eax
dec eax
je 0x40562e
dec eax
je 0x4056a0
sub eax, ecx
je 0x40562e
sub eax, 0x5c
jne 0x40568c
push dword [ebp + 8]
lea eax, [ebp - 0x14c]
push 0x484864
push eax
call fcn.0044e4c5
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add esp, 0xc
cmp dword [ebp + 0xc], ecx
jl 0x405652
xor eax, eax
lea ecx, [ebp - 0x14c]
push ecx
push eax
push 0x17
mov ecx, edi
call fcn.00412770
mov ecx, ebx
mov esi, eax
call fcn.00404d53
cmp esi, 2
jne 0x40568c
push 0
push 0
push 3
mov ecx, edi
call fcn.00412770
cmp eax, 0x3fb
jne 0x40568c
mov dword [ebp - 0x10], 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
mov ecx, ebx
call fcn.00404d53
xor esi, esi
cmp dword [ebp + 0x18], esi
je 0x4056f8
push dword [ebp + 0x18]
lea ecx, [ebp - 0x48]
call fcn.00403846
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], esi
call fcn.004047e4
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0040155a
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4056e6
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040155a
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
cmp dword [ebp + 0xc], ecx
jl 0x405705
xor eax, eax
push dword [ebp + 0x14]
mov ecx, edi
push eax
push 7
call fcn.00412770
cmp eax, 2
jmp 0x405683
Function at 0x40859b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push dword [0x49e3e4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4085ff
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x49e2d4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4085f6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x408604
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push dword [0x49e3e4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408663
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push dword [0x49e2d8]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40865a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret

Function at 0x408668
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [0x49e3e4]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
je 0x4086ab
lea eax, [ebp - 4]
push eax
push dword [0x49e3e4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4086cd
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [0x49e2d4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x4086d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [0x49e3e4]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
je 0x408713
lea eax, [ebp - 4]
push eax
push dword [0x49e3e4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x408735
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [0x49e2d8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x40d394
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x47dcaa
call fcn.0044d428
push ecx
fld qword [0x484e90]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
xor eax, eax
fstp qword [esi + 0x10]
inc eax
push edi
mov dword [esi], 0x484e88
mov dword [esi + 8], 3
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], 0x32
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov byte [esi + 0x28], bl
mov byte [esi + 0x29], bl
mov dword [esi + 0x2c], 0x1f4
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [esi + 0x38], al
mov byte [esi + 0x39], bl
mov byte [esi + 0x3a], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x484e70
push edi
call fcn.0044c6be
test eax, eax
pop ecx
pop ecx
jne 0x40d452
push 0x484e58
push edi
call fcn.0044c6be
test eax, eax
pop ecx
pop ecx
jne 0x40d452
push 0x50
call fcn.004637cb
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x40d433
mov ecx, eax
call fcn.00417dbe
jmp 0x40d435
xor eax, eax
fld qword [0x484e50]
mov dword [esi + 0x3c], eax
fstp qword [esi + 0x10]
mov dword [esi + 8], 3
mov dword [esi + 0x2c], 0x1f4
mov byte [esi + 0x40], bl
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40ddbb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004047e4
cmp dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
jae 0x40dddb
lea eax, [ebp - 0x18]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
push 0
sbb bl, bl
push 1
lea ecx, [ebp - 0x1c]
inc bl
call fcn.0040155a
mov al, bl
pop ebx
leave
ret

Function at 0x40ddfd
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
xor bl, bl
call fcn.004047e4
cmp dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
jae 0x40de20
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40de2d
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040155a
mov al, bl
pop ebx
leave
ret
Function at 0x40e411
Capabilities:
Move file

Disassembly:
mov eax, 0x47dd8d
call fcn.0044d428
sub esp, 0x54
push ebx
push esi
push edi
push 6
pop ecx
push dword [ebp + 8]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x60], esi
lea edi, [ebp - 0x5c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x40]
push eax
call fcn.004047e4
pop ecx
pop ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x5c], 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x28], 0x10
mov edi, dword [ebp - 0x3c]
mov byte [ebp - 4], 1
jae 0x40e463
lea edi, [ebp - 0x3c]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040d621
push dword [ebp - 0x14]
mov eax, dword [eax]
push eax
xor ecx, ecx
push edi
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040dea3
lea eax, [ebp - 0xd]
push eax
push 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
mov byte [ebp - 0xd], 0
call fcn.0040e07a
lea eax, [ebp - 0xd]
push eax
push 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
mov byte [ebp - 0xd], 0
call fcn.0040e07a
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov word [ebp - 0x50], 0x494
jne 0x40e4c3
mov word [ebp - 0x50], 0x1494
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp - 0x24]
inc bl
call fcn.0041709e
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.0040155a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40e4f9
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x47dda7
call fcn.0044d428
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.004047e4
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
xor edi, edi
cmp dword [ebp - 0x10], 0x10
mov dword [ebp - 4], edi
jae 0x40e528
lea eax, [ebp - 0x24]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
mov bl, 1
jne 0x40e5a6
push dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
call fcn.0040e2c7
pop ecx
pop ecx
cmp dword [ebp - 0x30], edi
mov byte [ebp - 4], bl
je 0x40e55d
lea eax, [ebp - 0x44]
push eax
call fcn.0040e4f9
mov bl, al
test bl, bl
pop ecx
je 0x40e59b
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x40e569
lea eax, [ebp - 0x24]
push eax
call esi
test eax, eax
jne 0x40e59b
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x40e57c
lea eax, [ebp - 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x40e59b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
push edi
push 1
lea ecx, [ebp - 0x44]
call fcn.0040155a
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0040155a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e5c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40e5e5
xor eax, eax
jmp 0x40e706
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x214]
push eax
mov edi, 0x104
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
cmp esi, ebx
je 0x40e701
cmp esi, edi
jb 0x40e61e
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x40e701
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x40e701
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0x214]
push edx
push ebx
push ebx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jge 0x40e676
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x40e667
and eax, 0xffff
push eax
jmp 0x40e669
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x40e6f8
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov esi, eax
cmp esi, ebx
jne 0x40e69f
cmp word [ebp - 0x214], bx
je 0x40e69f
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40e6d5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea edi, [esi + 1]
cmp edi, dword [ebp + 0x10]
jbe 0x40e6c2
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, edi
jmp 0x40e6d5
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x40e6f8
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40e7fa
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov eax, 0x47dddb
call fcn.0044d428
sub esp, 0x468
push ebx
push esi
xor ebx, ebx
push 0x410
lea eax, [ebp - 0x474]
push ebx
push eax
mov byte [ebp - 0xd], bl
call fcn.0044d4a0
add esp, 0xc
lea eax, [ebp - 0x474]
push eax
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40e913
push esi
lea eax, [ebp - 0x474]
push eax
push eax
call dword [0x49e338]
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x64]
call fcn.00402bb5
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], ebx
call fcn.004046ef
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0040287e
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e8f5
cmp byte [ebp + 0xc], bl
je 0x40e8f5
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004014a9
lea eax, [ebp - 0x474]
push eax
mov byte [ebp - 4], 3
call fcn.0044d447
inc eax
pop ecx
add eax, eax
push eax
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004037ba
lea eax, [ebp - 0x2c]
push eax
call fcn.0041bd62
test al, al
pop ecx
je 0x40e8e8
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
push eax
call fcn.00401a50
mov byte [ebp - 0xd], 1
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040155a
jmp 0x40e908
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
push eax
call fcn.00401a50
mov byte [ebp - 0xd], 1
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040155a
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40eb85
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov eax, 0x47ddfd
call fcn.0044d428
sub esp, 0x74
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.004047e4
push dword [ebp + 0xc]
lea eax, [ebp - 0x64]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004047e4
push dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.004047e4
push dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.004047e4
add esp, 0x20
cmp dword [ebp - 0x6c], ebx
jbe 0x40ebec
cmp dword [ebp - 0x68], 0x10
jb 0x40ebe7
mov eax, dword [ebp - 0x7c]
mov dword [ebp + 0x10], eax
jmp 0x40ebef
lea eax, [ebp - 0x7c]
jmp 0x40ebe2
mov dword [ebp + 0x10], ebx
cmp dword [ebp - 0x50], ebx
jbe 0x40ec07
cmp dword [ebp - 0x4c], 0x10
jb 0x40ec02
mov eax, dword [ebp - 0x60]
mov dword [ebp + 0xc], eax
jmp 0x40ec0a
lea eax, [ebp - 0x60]
jmp 0x40ebfd
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x34], ebx
jbe 0x40ec22
cmp dword [ebp - 0x30], 0x10
jb 0x40ec1d
mov eax, dword [ebp - 0x44]
mov dword [ebp + 8], eax
jmp 0x40ec25
lea eax, [ebp - 0x44]
jmp 0x40ec18
mov dword [ebp + 8], ebx
cmp dword [ebp - 0x18], ebx
jbe 0x40ec3a
cmp dword [ebp - 0x14], 0x10
jb 0x40ec35
mov esi, dword [ebp - 0x28]
jmp 0x40ec3c
lea esi, [ebp - 0x28]
jmp 0x40ec3c
xor esi, esi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ec81
push edi
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
push esi
mov dword [ebp + 0x14], 0xfeff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 2
lea eax, [ebp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call esi
test eax, eax
setg byte [ebp + 0xb]
cmp byte [ebp + 0xb], bl
je 0x40ecb0
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40ecaa
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
call esi
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040155a
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.0040155a
push ebx
push esi
lea ecx, [ebp - 0x64]
call fcn.0040155a
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.0040155a
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xb]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10