joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x4f2008]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.00497aa0
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406d7e
cmp dword [esp + 0x14], 6
jb 0x406d7e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00406b70
add esp, 0xc
test al, al
je 0x406d7e
cmp word [esi], 0
jne 0x406dd6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00406b70
add esp, 0xc
test al, al
je 0x406daa
cmp word [esi], 0
jne 0x406dd6
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00406b70
add esp, 0xc
test al, al
je 0x406deb
cmp word [esi], 0
je 0x406deb
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x4073c0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.004aea20
push 0xffffffffffffffff
push 0x4b9b08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp + 0x630]
push ebx
push eax
call fcn.00497aa0
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x4075c1
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x4075c1
push esi
call edi
cmp eax, 0xffa
jge 0x4075c1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x4d7b28
lea eax, [ebp + 0x630]
push eax
call esi
push str.Shell32.dll
lea ecx, [ebp - 0x2c]
call fcn.00401931
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.00414c50
mov ecx, eax
call fcn.00414d10
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040192c
test esi, esi
je 0x4075c1
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4075c1
lea ecx, [ebp]
call fcn.00406e00
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x4074e6
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x10]
cmp eax, 0x20
ja 0x4074f4
inc edi
add esi, 0x210
cmp edi, 3
jl 0x4074c5
jmp 0x407516
imul ebx, edi, 0x210
cmp dword [ebp + ebx + 0x208], 0
mov ebx, dword [ebp + ebx + 0x20c]
jne 0x40750e
add ebx, 0x10
test ebx, ebx
jne 0x4075bd
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x4075b8
mov dword [ebp - 0x14], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x10], str._programfiles_Internet_Exploreriexplore.exe
nop dword [eax + eax]
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x14]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4075ae
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x4075b8
inc esi
cmp esi, 2
jb 0x407550
mov eax, ebx
jmp 0x4075c3
mov ebx, 0x10
mov eax, ebx
jmp 0x4075c3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.00495ca5
lea esp, [ebp + 0x283c]
pop ebp
ret
Function at 0x407940
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
mov dword [esi], 0
mov word [esi + 4], 0
call fcn.00402620
test al, al
jne 0x407967
mov ecx, dword [esp + 8]
call fcn.00401921
jmp 0x407969
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x407991
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x407993
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x4079c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9be8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x407a06
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.00415c40
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x407a2f
lea ebx, [esi + 8]
jmp 0x407a31
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00402620
test al, al
jne 0x407a47
mov ecx, dword [ebp - 0x18]
call fcn.00401921
jmp 0x407a49
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x407a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407a6a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x407a93
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x407aa8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.00495ce6
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret 4

Function at 0x407b00
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4f2008]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.00495cb6
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call fcn.00497aa0
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x407b5c
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.00495ca5
add esp, 0x120
ret
Function at 0x40a010
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x4f2008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call fcn.00497aa0
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a152
cmp dword [esi + 4], 6
push edi
ja 0x40a066
jne 0x40a0ee
cmp dword [esi + 8], 2
jb 0x40a0ee
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x40a0ee
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40a0ee
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a0ee
movups xmm0, xmmword [0x4dbe10]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x4dbe20]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40a0ee
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40a0ee
cmp word [edi + 2], ax
jbe 0x40a0ee
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40a139
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x40a139
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.00495ca5
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.00495ca5
add esp, 0x140
ret
Function at 0x40c6f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba198
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402620
test al, al
je 0x40c72d
xor al, al
jmp 0x40c861
push esi
lea ecx, [ebp - 0x28]
call fcn.00402693
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00402bb0
lea ecx, [ebp - 0x28]
call fcn.00401921
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c84e
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40c78e
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040192c
cmp esi, 0xffffffff
jne 0x40c84e
lea ecx, [ebp - 0x28]
call fcn.00402630
cmp eax, 2
jbe 0x40c84a
lea ecx, [ebp - 0x28]
call fcn.00402630
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00401970
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x40c7d3
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x40c7f2
lea ecx, [ebp - 0x28]
call fcn.00402630
cmp dword [esi + 0x14], 8
jb 0x40c7ea
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x40c84a
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00402bb0
lea ecx, [ebp - 0x28]
call fcn.00401921
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c84e
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40c839
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040192c
cmp esi, 0xffffffff
jne 0x40c84e
xor bl, bl
jmp 0x40c850
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x40c880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba198
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402620
test al, al
je 0x40c8bd
xor al, al
jmp 0x40c9f7
push esi
lea ecx, [ebp - 0x28]
call fcn.00402693
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00402bb0
lea ecx, [ebp - 0x28]
call fcn.00401921
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c92b
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40c91a
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040192c
cmp ebx, 0xffffffff
je 0x40c934
test bl, 0x10
je 0x40c9e4
lea ecx, [ebp - 0x28]
call fcn.00402630
cmp eax, 2
jbe 0x40c9e0
lea ecx, [ebp - 0x28]
call fcn.00402630
lea ecx, [ebp - 0x28]
lea ebx, [eax - 1]
call fcn.00401970
mov esi, eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x40c964
mov ecx, dword [esi]
cmp word [ecx + ebx*2], 0x5c
je 0x40c983
lea ecx, [ebp - 0x28]
call fcn.00402630
cmp dword [esi + 0x14], 8
jb 0x40c97b
mov esi, dword [esi]
cmp word [esi + eax*2 - 2], 0x2f
jne 0x40c9e0
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.00402bb0
lea ecx, [ebp - 0x28]
call fcn.00401921
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40c9db
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40c9ca
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call edi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040192c
cmp ebx, 0xffffffff
je 0x40c9e0
test bl, 0x10
je 0x40c9e4
xor bl, bl
jmp 0x40c9e6
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x40ca20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba1d0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00402620
test al, al
je 0x40ca5c
xor al, al
jmp 0x40cae6
push esi
lea ecx, [ebp - 0x28]
call fcn.00402693
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.00402bb0
lea ecx, [ebp - 0x28]
call fcn.00401921
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40caca
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40cab9
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.0040192c
cmp ebx, 0xffffffff
je 0x40cad3
test bl, 0x10
je 0x40cad3
mov bl, 1
jmp 0x40cad5
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x40d040
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00402620
test al, al
je 0x40d07d
xor al, al
jmp 0x40d229
mov ecx, edi
call fcn.0040ca20
test al, al
je 0x40d08f
mov al, 1
jmp 0x40d229
push 0
mov ecx, edi
call fcn.00401921
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x40d0de
lea ecx, [ebp - 0x28]
call fcn.00401bd5
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.00419c90
test al, al
je 0x40d0cf
push 0
lea ecx, [ebp - 0x28]
call fcn.00401921
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
mov ecx, edi
call fcn.0040ca20
test al, al
jne 0x40d088
mov ecx, edi
call fcn.00402630
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x40d1ce
mov ecx, edi
call fcn.00401970
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x40d112
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x40d135
mov eax, ebx
cmp ecx, 8
jb 0x40d12b
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x40d1be
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004030d0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00402620
test al, al
jne 0x40d1af
lea ecx, [ebp - 0x28]
call fcn.0040c6f0
test al, al
jne 0x40d1af
push 0
lea ecx, [ebp - 0x28]
call fcn.00401921
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40d1af
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.00419c90
test al, al
je 0x40d1a3
push 0
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040192c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x40d106
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.0040c6f0
test al, al
jne 0x40d222
push 0
mov ecx, edi
call fcn.00401921
push eax
call ebx
test eax, eax
jne 0x40d222
lea ecx, [ebp - 0x40]
call fcn.00401bd5
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.00419c90
test al, al
je 0x40d213
push 0
lea ecx, [ebp - 0x40]
call fcn.00401921
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040192c
mov ecx, edi
call fcn.0040ca20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x40d9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba398
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4f2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x4d7c28
call fcn.0040e760
cmp eax, 0xffffffff
jne 0x40da36
mov ecx, esi
call fcn.00401921
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x40da31
lea ecx, [ebp - 0x28]
call fcn.00401bd5
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00419c90
test al, al
je 0x40da1f
lea ecx, [ebp - 0x28]
call fcn.00401921
push eax
call ebx
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040192c
cmp edi, 0xffffffff
setne al
jmp 0x40da62
lea ecx, [ebp - 0x68]
call fcn.00418450
mov dword [ebp - 4], 1
lea edx, [ebp - 0x68]
mov ecx, esi
call fcn.00418bd0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040192c
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00495ca5
mov esp, ebp
pop ebp
ret
Function at 0x40dbb0
Capabilities:
Get common file path

Disassembly:
jmp 0x419a50
sub esp, 0x42c
mov eax, dword [0x4f2008]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, ecx
call fcn.00402634
push 0x412
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x419c60
cmp eax, 0x208
jae 0x419c60
push ebx
xor eax, eax
push esi
mov word [esp + 0x430], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00401a44
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.00401970
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x419b09
mov esi, edi
cmp eax, 8
jb 0x419adc
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.00401a12
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
add esp, 0x14
jmp 0x419c45
mov ecx, ebp
call fcn.00401b82
cmp ebx, eax
ja 0x419c78
mov ecx, ebp
call fcn.00401b82
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x419b5f
mov ecx, ebp
call fcn.00401970
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x419b5f
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004019ef
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x419b71
or ecx, 0xffffffff
jmp 0x419b79
cmp ecx, 0x1000
jb 0x419ba2
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.00495cb6
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x419c7d
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x419bb3
test ecx, ecx
je 0x419bb1
push ecx
call fcn.00495cb6
add esp, 4
jmp 0x419bb3
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.00401a2b
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.00401a01
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x419c24
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x419c12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419c7d
mov eax, edx
push ecx
push eax
call fcn.00495ce6
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x419c45
lea eax, [esp + 0x10]
push eax
call fcn.00401a5f
push edi
mov esi, eax
call fcn.00401a5f
push eax
push 4
call fcn.00401880
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00495ca5
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor al, al
pop ebp
xor ecx, esp
call fcn.00495ca5
add esp, 0x42c
ret
call fcn.00401b40
call fcn.00499d54
int3