joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405d67
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4314a0
call fcn.00431274
sub esp, 0x424
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, ecx
push edi
mov dword [ebp - 0x18], eax
lea edi, [eax + 0x420]
push edi
push 0x104
lea ecx, [eax + 0x216]
push ecx
push 0x43c0ec
lea ebx, [eax + 0x834]
mov dword [ebp - 0x14], ecx
push 0x43d5d8
push ebx
call esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0x43c0ec
push 0x43d5e8
push ebx
call esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x14]
call fcn.004206c6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040c938
push edi
push 0x104
lea eax, [ebp - 0x430]
mov edi, str.WDUPDATE.NET
push eax
push edi
push str.FICUPDATE
push ebx
call esi
mov eax, dword [ebp - 0x18]
lea ebx, [eax + 0x216]
lea esi, [eax + 0x62a]
push ebx
push esi
call fcn.004206a4
lea eax, [ebp - 0x430]
push eax
push esi
call fcn.004206c6
add esp, 0x10
mov ecx, esi
call fcn.0040c6d1
test eax, eax
jne 0x405e70
push edi
push ebx
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00402dfa
add esp, 0x10
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040fb17
mov ecx, eax
call fcn.0040c6d1
test eax, eax
je 0x405e68
lea ecx, [ebp - 0x10]
call fcn.0040fb17
push eax
push esi
call fcn.004206a4
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0040fa89
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40615e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ecx + 0x11b9], 0
push ebx
jne 0x4061e6
push esi
push edi
lea esi, [ecx + 0x420]
push esi
push 0
lea edi, [ecx + 0x834]
push str.DELAICHECKVERSION
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 9
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push 0x43c0ec
push str.LASTCHECKVERSION
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x30]
call fcn.0040651f
pop edi
pop esi
test ebx, ebx
jle 0x4061e6
cmp word [ebp - 0x1c], 0
je 0x4061e6
and dword [ebp - 4], 0
lea edx, [ebp - 4]
lea ecx, [ebp - 0x30]
call fcn.0040654e
and dword [ebp - 8], 0
lea edx, [ebp - 8]
lea ecx, [ebp - 0x1c]
call fcn.0040654e
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
cmp eax, ebx
jge 0x4061e6
xor eax, eax
jmp 0x4061e9
xor eax, eax
inc eax
pop ebx
leave
ret

Function at 0x406c16
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
cmp word [ecx], 0
jne 0x406c26
xor eax, eax
jmp 0x406c3c
push ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop ebp
ret 0x14

Function at 0x406c81
Capabilities:
Read .ini file

Disassembly:
add ecx, 4
cmp word [ecx], 0
jne 0x406c8e
xor eax, eax
jmp 0x406ca1
push ecx
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 0xc
Function at 0x4071be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x44a44c]
push ebx
push esi
push edi
and dword [eax + 0xc], 0
push 0x3e9
push dword [eax + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
mov ecx, esi
call fcn.0040ed53
push esi
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp - 4]
push edi
lea ecx, [esi + 0x10]
call fcn.0040626a
push edi
call fcn.00421125
mov dword [esp], 0x3ea
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
mov ecx, esi
call fcn.0040ed53
push esi
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [ebp - 4]
push edi
lea ecx, [ebx + 0x14]
call fcn.0040626a
push edi
call fcn.00421125
pop ecx
push 0
push 0
push 2
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4073c7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x431697
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
call fcn.004076fb
lea ecx, [esi + 0x30]
call fcn.00410ac8
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x20]
call fcn.00406a78
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0x1c]
call fcn.00406a78
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x18]
call fcn.00406a78
mov dword [ebp - 4], 3
mov ecx, dword [esi + 0x14]
call fcn.00406a78
mov dword [ebp - 4], 4
mov ecx, dword [esi + 0x10]
call fcn.00406a78
mov dword [ebp - 4], 5
mov ecx, dword [esi + 0xc]
call fcn.00406a78
mov dword [ebp - 4], 6
mov ecx, dword [esi + 4]
call fcn.00406a78
mov dword [ebp - 4], 7
mov ecx, dword [esi]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x407475
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4316b8
call fcn.00431274
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
mov edi, dword [ebp + 0xc]
push ebx
push 0x104
push eax
push 0x43c0ec
push 0x43d5d8
push edi
mov dword [ebp - 0x10], ecx
call esi
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [eax + 4]
call fcn.0040626a
push ebx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x43c0ec
push 0x43d5e8
push edi
call esi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ecx + 0x20]
call fcn.0040626a
mov ecx, dword [ebp - 0x10]
push str.PC_SOFT
lea ecx, [ecx + 0xc]
call fcn.0040626a
push ebx
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x43f1ac
push 0x43f1b0
push edi
call esi
push 0x30
pop ecx
xor eax, eax
cmp word [ebp - 0x21c], cx
mov ecx, dword [ebp - 0x10]
push ebx
setne al
push 0x104
mov dword [ecx + 0x28], eax
lea eax, [ebp - 0x21c]
push eax
push 0x43f1ac
push str.HTTPSECURE
push edi
call esi
mov ebx, dword [ebp - 0x10]
xor eax, eax
push 0x30
pop edx
cmp word [ebp - 0x21c], dx
mov ecx, str.HTTP
setne al
mov dword [ebp + 0xc], eax
mov eax, str.HTTPS
cmove eax, ecx
mov ecx, ebx
push eax
call fcn.0040626a
and dword [ebp + 8], 0
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x43f1a8
push 1
lea edi, [ebx + 4]
mov ecx, edi
call fcn.00406376
test eax, eax
je 0x4075d8
mov esi, dword [edi]
test esi, esi
je 0x40759d
lock inc dword [esi - 0xc]
mov dword [ebp + 0xc], esi
push edi
push 0x43f1a8
push 0
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00406376
cmp dword [ebp + 8], 0
mov eax, 0x43c0ec
cmovne eax, dword [ebp + 8]
push eax
call fcn.00421a52
pop ecx
mov dword [ebx + 8], eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00406a78
jmp 0x4075ea
cmp dword [ebp + 0xc], 0
mov ecx, 0x1bb
push 0x50
pop eax
cmovne eax, ecx
mov dword [ebx + 8], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp + 8]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40a1c0
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x431879
call fcn.00431274
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgression.0
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0x64
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov byte [ebp - 4], 2
push ecx
mov dword [esi + 0x38], eax
call fcn.0040a29f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40b408
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0xc]
mov eax, dword [ecx + 0x20c]
test eax, eax
cmovne ecx, eax
call fcn.0040d37f
test eax, eax
jne 0x40b54e
push 0x43f6d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x40b54e
push str.NtQueryInformationFile
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40b54e
push 0x20e
xor ebx, ebx
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.0041b240
add esp, 0xc
lea eax, [ebp - 0x258]
push 9
push 0x20c
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x21c]
call esi
test eax, eax
js 0x40b54e
mov eax, dword [ebp - 0x258]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2 - 0x254], cx
lea eax, [ebp - 0x48]
push eax
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x40b54e
push 0x410
lea eax, [ebp - 0x668]
push ebx
push eax
call fcn.0041b240
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
movzx eax, word [ebp - 0x668]
lea esi, [ebp - 0x668]
mov dword [ebp - 0xc], 0x3a0020
mov dword [ebp - 8], 0x5c
mov word [ebp - 0xc], ax
cmp ax, 0x41
je 0x40b53b
cmp ax, 0x42
je 0x40b53b
lea ecx, [ebp - 0xc]
call fcn.0040d30f
cmp eax, 3
jne 0x40b53b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x2c]
je 0x40b557
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x40b53b
movzx eax, word [esi]
test ax, ax
jne 0x40b4ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push 2
push eax
push esi
call fcn.00420af1
push 0x102
lea eax, [ebp - 0x254]
push eax
lea eax, [esi + 4]
push eax
call fcn.00420af1
xor eax, eax
add esp, 0x18
inc eax
jmp 0x40b550
Function at 0x40b685
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 8]
call fcn.00411468
cmp dword [esp + 0x10], 0
jne 0x40b6ad
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40b6a5
and dword [ecx], 0
xor eax, eax
inc eax
jmp 0x40b775
push ebx
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 8]
add dword [edi + 0x220], eax
adc dword [edi + 0x224], 0
test ecx, ecx
je 0x40b6e6
mov dword [ecx], eax
test ebx, ebx
jne 0x40b772
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 8]
mov esi, eax
push 3
call fcn.00411468
mov ecx, dword [edi + 8]
mov ebp, 0x43eeb8
push 1
push ebp
call fcn.00411341
push ecx
mov ecx, dword [edi + 8]
push esi
call fcn.00411b0c
push dword [edi + 0x21c]
push str._IXStream__Handle__p_
push dword [edi + 8]
call fcn.00411738
push dword [edi + 0x230]
push str._IXStream__Access__x_
push dword [edi + 8]
call fcn.00411738
add esp, 0x18
mov ecx, edi
call fcn.0040d9ef
push eax
push 0x6d68
push ebp
push dword [edi + 8]
call fcn.00411577
add esp, 0x10
mov ecx, edi
call fcn.0040d9ef
mov ecx, dword [edi + 8]
push eax
push 1
call fcn.004117d3
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
pop ecx
ret 0xc
Function at 0x40b77a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
mov ecx, dword [esi + 8]
call fcn.00411468
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x18]
test eax, eax
push 0
cmovne ebx, eax
xor ecx, ecx
push ebx
test eax, eax
mov eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x2c]
sete cl
mov dword [esp + 0x20], eax
and dword [ebx], 0
push dword [esi + 0x21c]
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x24], 0
mov edi, eax
mov ebp, dword [ebx]
jbe 0x40b81d
test edi, edi
jne 0x40b81d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40b7ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xa2
jne 0x40b81d
mov eax, dword [esp + 0x10]
sub eax, dword [ebx]
mov ecx, dword [esp + 0x20]
add ecx, dword [ebx]
push 0
push ebx
push eax
push ecx
push dword [esi + 0x21c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
add ebp, dword [ebx]
mov edi, eax
cmp dword [esp + 0x10], 0
jne 0x40b7cf
mov dword [ebx], ebp
add dword [esi + 0x220], ebp
adc dword [esi + 0x224], 0
test edi, edi
je 0x40b844
cmp dword [esp + 0x28], 0
jne 0x40b83d
cmp ebp, dword [esp + 0x24]
jne 0x40b844
mov eax, edi
jmp 0x40b901
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 8]
mov ebx, eax
push 3
call fcn.00411468
mov ecx, dword [esi + 8]
push 1
push 0x43eeb8
call fcn.00411341
mov ecx, dword [esi + 8]
push ecx
test edi, edi
je 0x40b871
push 0
jmp 0x40b872
push ebx
call fcn.00411b0c
push dword [esi + 0x21c]
push str._IXStream__Handle__p_
push dword [esi + 8]
call fcn.00411738
push dword [esp + 0x20]
push str._IXStream__bExact__d_
push dword [esi + 8]
call fcn.00411738
push ebp
push dword [esp + 0x40]
push str._IXStream__A_lire__u___lu__u_
push dword [esi + 8]
call fcn.00411738
mov ecx, dword [esi + 0x220]
mov eax, dword [esi + 0x224]
sub ecx, ebp
sbb eax, 0
push eax
push ecx
push str._IXStream__Offset__I64u_
push dword [esi + 8]
call fcn.00411738
add esp, 0x38
mov ecx, esi
call fcn.0040d9ef
push eax
push 0x6d63
push 0x43eeb8
push dword [esi + 8]
call fcn.00411577
add esp, 0x10
mov ecx, esi
call fcn.0040d9ef
mov ecx, dword [esi + 8]
push eax
push 1
call fcn.004117d3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x40bd80
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 8]
call fcn.00411468
mov eax, dword [ebp + 0x10]
sub eax, 0
je 0x40bda1
sub eax, 1
jne 0x40bdb4
push 2
jmp 0x40bda3
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 8]
call dword [eax + 0x24]
test eax, eax
jne 0x40bdbb
xor eax, eax
jmp 0x40be43
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40be40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 8]
mov esi, eax
push 3
call fcn.00411468
mov ecx, dword [edi + 8]
mov ebx, 0x43eeb8
push 1
push ebx
call fcn.00411341
push ecx
mov ecx, dword [edi + 8]
push esi
call fcn.00411b0c
push dword [edi + 0x21c]
push str._IXStream__Handle__p_
push dword [edi + 8]
call fcn.00411738
add esp, 0xc
mov ecx, edi
call fcn.0040d9ef
push eax
push 0x6d64
push ebx
push dword [edi + 8]
call fcn.00411577
add esp, 0x10
mov ecx, edi
call fcn.0040d9ef
mov ecx, dword [edi + 8]
push eax
push 1
call fcn.004117d3
pop esi
xor eax, eax
pop ebx
jmp 0x40be43
xor eax, eax
inc eax
pop edi
pop ebp
ret 0xc

Function at 0x40c307
Capabilities:
Delete file

Disassembly:
mov eax, 0x4318ea
call fcn.00431274
sub esp, 0x220
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x22c]
push edi
call fcn.0040b329
and dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
push 0
push esi
call fcn.0040e251
cmp dword [ebp - 0x20], 0
lea esi, [ebp - 0x22c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmovne esi, dword [ebp - 0x20]
push 0x8001
mov dword [ebp - 0x14], esi
call ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.004050a5
xor ebx, ebx
inc ebx
test eax, eax
je 0x40c3ac
push ebx
mov edi, 0x43eeb8
xor ecx, ecx
push edi
call fcn.00411341
mov esi, dword [ebp - 0x14]
push esi
push 0x6ddb
push edi
push 0
call fcn.00411559
add esp, 0x10
xor ecx, ecx
push esi
push ebx
call fcn.004117d3
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x20]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40c3c9
Capabilities:
Delete file

Disassembly:
push ecx
push ecx
push ebp
push esi
push edi
push 0x8001
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x40c447
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40c447
push ecx
mov edx, ebp
lea ecx, [esp + 0x14]
call fcn.0040cba2
pop ecx
test eax, eax
je 0x40c443
mov edx, dword [esp + 0x10]
push ecx
and edx, 0xfffffffe
mov ecx, ebp
call fcn.0040cca0
pop ecx
test eax, eax
je 0x40c443
mov ecx, ebp
pop edi
pop esi
pop ebp
add esp, 8
jmp fcn.0040c307
xor eax, eax
jmp 0x40c47c
call fcn.004050a5
test eax, eax
je 0x40c47a
push 1
mov edi, 0x43eeb8
xor ecx, ecx
push edi
call fcn.00411341
push ebp
push 0x6ddb
push edi
push 0
call fcn.00411559
add esp, 0x10
xor ecx, ecx
push ebp
push 1
call fcn.004117d3
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
pop ecx
ret

Function at 0x40c482
Capabilities:
Move file

Disassembly:
mov eax, 0x431911
call fcn.00431274
sub esp, 0x42c
push ebx
push esi
push edi
push 0x8001
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp - 0x438]
mov ebx, eax
call fcn.0040b329
and dword [ebp - 4], 0
lea ecx, [ebp - 0x438]
push 0
push esi
call fcn.0040e251
cmp dword [ebp - 0x22c], 0
lea esi, [ebp - 0x438]
lea ecx, [ebp - 0x228]
cmovne esi, dword [ebp - 0x22c]
mov dword [ebp - 0x10], esi
call fcn.0040b329
push 0
push edi
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0040e251
cmp dword [ebp - 0x1c], 0
lea edi, [ebp - 0x228]
cmovne edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.004050a5
test eax, eax
je 0x40c567
push 1
mov ebx, 0x43eeb8
xor ecx, ecx
push ebx
call fcn.00411341
mov esi, dword [ebp - 0x10]
push esi
push edi
push 0x6ddc
push ebx
push 0
call fcn.00411559
add esp, 0x14
xor ecx, ecx
push esi
push 1
call fcn.004117d3
push edi
push 2
xor ecx, ecx
call fcn.004117d3
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
call fcn.00406a78
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x22c]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40c5ad
Capabilities:
Copy file

Disassembly:
mov eax, 0x431911
call fcn.00431274
sub esp, 0x42c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x8001
mov dword [ebp - 0x14], esi
call ebx
lea ecx, [ebp - 0x438]
mov edi, eax
call fcn.0040b329
and dword [ebp - 4], 0
lea ecx, [ebp - 0x438]
push 0
push esi
call fcn.0040e251
lea ecx, [ebp - 0x228]
call fcn.0040b329
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0040e251
cmp dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x228]
push 0
cmovne ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x438]
cmp dword [ebp - 0x22c], 0
push ecx
cmovne eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
call esi
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.004050a5
test eax, eax
je 0x40c6a1
push 1
mov edi, 0x43eeb8
xor ecx, ecx
push edi
call fcn.00411341
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
push esi
push ebx
push 0x6ddd
push edi
push 0
call fcn.00411559
add esp, 0x14
xor ecx, ecx
push esi
push 1
call fcn.004117d3
push ebx
push 2
xor ecx, ecx
call fcn.004117d3
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
call fcn.00406a78
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x22c]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40c80e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, esi
push 0x3a
mov edi, dword [esi + 0x20c]
test edi, edi
pop ecx
cmovne eax, edi
cmp cx, word [eax + edx*2 - 2]
jne 0x40c83b
cmp byte [esp + 0x24], 0
je 0x40c8be
jmp 0x40c879
test edi, edi
mov ecx, esi
cmovne ecx, edi
dec edx
push ecx
call fcn.0040ee45
pop ecx
mov ebx, eax
mov byte [esp + 0x13], 0
push 0x5c
pop ebp
test ebx, ebx
je 0x40c89b
test edi, edi
mov eax, esi
cmovne eax, edi
add eax, 2
cmp eax, ebx
jne 0x40c88d
test edi, edi
mov eax, esi
cmovne eax, edi
cmp word [eax], bp
jne 0x40c88d
cmp byte [esp + 0x24], 0
je 0x40c888
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40c919
mov byte [esp + 0x13], 1
test edi, edi
mov eax, esi
cmovne eax, edi
xor ecx, ecx
cmp eax, ebx
cmove ebx, ecx
test edi, edi
mov eax, esi
cmovne eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c8b7
mov ecx, eax
call fcn.0040c921
jmp 0x40c919
cmp byte [esp + 0x13], 0
je 0x40c8c3
xor eax, eax
inc eax
jmp 0x40c919
test ebx, ebx
je 0x40c8f0
xor eax, eax
mov ecx, esi
mov word [ebx], ax
mov edx, ebx
mov eax, dword [esi + 0x20c]
test eax, eax
push 0
cmovne ecx, eax
sub edx, ecx
mov ecx, esi
sar edx, 1
call fcn.0040c80e
pop ecx
test eax, eax
je 0x40c881
mov word [ebx], bp
mov eax, dword [esi + 0x20c]
and dword [esp + 0x18], 0
and dword [esp + 0x1c], 0
test eax, eax
mov dword [esp + 0x14], 0xc
cmovne esi, eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40cbbe
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x4318ea
call fcn.00431274
sub esp, 0x220
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], edx
push edi
lea ecx, [ebp - 0x22c]
call fcn.0040b329
and dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
push 0
push esi
call fcn.0040e251
cmp dword [ebp - 0x20], 0
lea esi, [ebp - 0x22c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmovne esi, dword [ebp - 0x20]
push 0x8001
mov dword [ebp - 0x18], esi
call ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ecx], eax
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
call esi
push edi
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.004050a5
test eax, eax
je 0x40cc75
push 1
mov edi, 0x43eeb8
xor ecx, ecx
push edi
call fcn.00411341
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
push esi
push dword [eax]
push 0x6de2
push edi
push 0
call fcn.00411559
add esp, 0x14
xor ecx, ecx
push esi
push 1
call fcn.004117d3
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp dword [eax], 0xffffffff
setne bl
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
call fcn.00406a78
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret