joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d6a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
lea eax, [ebp - 0x30]
mov dword [ebp - 8], ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0043c748
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043630b
lea ecx, [ebp - 0x30]
call fcn.0043634f
lea ecx, [ebp - 0x1c]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x43d734
push ebx
push ebx
push 0x17d
push str.....RegistryWin32ECClearEntry.cpp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x30]
call fcn.0043634f
lea ecx, [ebp - 0x1c]
call fcn.0043634f
cmp dword [ebp - 4], ebx
je 0x43d872
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43d872
push edi
lea ecx, [ebp - 0x1c]
call fcn.0043634f
mov edi, dword [ebp + 0x10]
push esi
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 8]
call dword [eax + 8]
mov dword [ebp + 0x10], eax
lea ecx, [ebp - 0x1c]
lea eax, [ebp + 0x10]
push eax
call fcn.004362eb
lea ecx, [ebp - 0x1c]
call fcn.0043fe40
cmp eax, 0x7d1
jge 0x43d82d
lea ecx, [ebp - 0x1c]
call fcn.0043634f
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.00487fe2
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push ebx
call fcn.0043fcdc
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x43d741
test eax, eax
jne 0x43d7bf
push 3
pop ebx
push eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0x7d0
push eax
lea ecx, [ebp - 0x58]
call fcn.004362eb
lea ecx, [ebp - 0x44]
jmp 0x43d7d9
push 0xc
pop ebx
push 0
push eax
lea eax, [ebp - 0x1c]
push str.RegQueryValueEx
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x30]
push eax
call fcn.0043630b
mov ecx, dword [ebp + 8]
push 0
push eax
call fcn.0043630b
test bl, 8
je 0x43d7fa
lea ecx, [ebp - 0x30]
and ebx, 0xfffffff7
call fcn.0043634f
test bl, 4
je 0x43d80a
lea ecx, [ebp - 0x1c]
and ebx, 0xfffffffb
call fcn.0043634f
test bl, 2
je 0x43d81a
lea ecx, [ebp - 0x44]
and ebx, 0xfffffffd
call fcn.0043634f
test bl, 1
je 0x43d827
lea ecx, [ebp - 0x58]
call fcn.0043634f
cmp dword [ebp - 4], 0
jmp 0x43d865
push ebx
push ebx
push 0x182
push str.....RegistryWin32ECClearEntry.cpp
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x58]
call fcn.0043634f
lea ecx, [ebp - 0x1c]
call fcn.0043634f
cmp dword [ebp - 4], ebx
je 0x43d870
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43dc7a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push 1
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 4], edi
call fcn.0043c748
push eax
lea ecx, [ebp - 0x18]
call fcn.0043630b
lea ecx, [ebp - 0x2c]
call fcn.0043634f
lea ecx, [ebp - 0x18]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x43dcee
push edi
push edi
push 0x197
push str.....RegistryWin32ECClearEntry.cpp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x2c]
call fcn.0043634f
lea ecx, [ebp - 0x18]
jmp 0x43dd97
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.0043634f
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov esi, dword [ebp - 4]
push 4
push eax
push 4
push edi
call fcn.0043fcdc
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43dd34
push 3
pop ebx
push edi
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x7d0
push eax
lea ecx, [ebp - 0x54]
call fcn.004362eb
lea ecx, [ebp - 0x40]
jmp 0x43dd4d
push 0xc
pop ebx
push edi
push eax
lea eax, [ebp - 0x18]
push str.RegSetValueEx
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x2c]
push eax
call fcn.0043630b
mov ecx, dword [ebp + 8]
push edi
push eax
call fcn.0043630b
test bl, 8
je 0x43dd6d
lea ecx, [ebp - 0x2c]
and ebx, 0xfffffff7
call fcn.0043634f
test bl, 4
je 0x43dd7d
lea ecx, [ebp - 0x18]
and ebx, 0xfffffffb
call fcn.0043634f
test bl, 2
je 0x43dd8d
lea ecx, [ebp - 0x40]
and ebx, 0xfffffffd
call fcn.0043634f
pop esi
test bl, 1
pop ebx
je 0x43dd9c
lea ecx, [ebp - 0x54]
call fcn.0043634f
cmp dword [ebp - 4], edi
je 0x43ddaa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43e961
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x28
call fcn.0043ae73
push 0
cmp eax, 0x3e8
je 0x43e9a5
push 0
push 0x29
push str.......SharedFileCommonECDirectory.cpp
lea eax, [ebp - 0x14]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x43ea11
mov ecx, dword [ebp + 0xc]
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x43ea04
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x28]
push str.CreateDirectory__
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x28]
call fcn.0043634f
mov ecx, dword [ebp + 0xc]
call fcn.0043fcdc
push eax
lea eax, [ebp - 0x14]
push str.Unable_to_create_directory___s_
push eax
call fcn.0043667d
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
jmp 0x43e992
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x43ec04
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
mov edi, dword [ebp + 8]
call fcn.0043ae73
cmp eax, 0x3e8
je 0x43ec68
xor ebx, ebx
lea eax, [ebp - 0x2e4]
push ebx
push ebx
push 0xe7
push str.......SharedFileCommonECDirectory.cpp
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x2e4]
call fcn.0043634f
jmp 0x43edf4
push esi
lea ecx, [ebp - 0x18]
call fcn.00438449
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00440c49
pop ecx
pop ecx
lea ecx, [ebp - 0x2e4]
call fcn.0043634f
mov esi, 0x2b4
lea eax, [ebp - 0x2cc]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0046e5c0
add esp, 0xc
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.00441275
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0043630b
lea ecx, [ebp - 0x2f8]
call fcn.0043634f
lea ecx, [ebp - 0x2e4]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x43ed27
push ebx
push ebx
push 0xf1
push str.......SharedFileCommonECDirectory.cpp
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.004069d9
add esp, 0x14
mov ecx, edi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x2f8]
call fcn.0043634f
lea ecx, [ebp - 0x2e4]
call fcn.0043634f
jmp 0x43edec
lea ecx, [ebp - 0x2e4]
call fcn.0043634f
push 0x800
push esi
lea eax, [ebp - 0x2cc]
push eax
push ebx
lea ecx, [ebp - 0x18]
call fcn.0043fcdc
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test esi, esi
jne 0x43edc7
mov esi, eax
test esi, esi
je 0x43edc7
push ebx
lea ecx, [ebp - 0x2e4]
call fcn.00436332
cmp esi, 3
je 0x43eda3
cmp esi, 2
je 0x43eda3
push esi
lea eax, [ebp - 0x2f8]
push str.SHGetFileInfo
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x2e4]
push eax
call fcn.00436382
lea ecx, [ebp - 0x2f8]
call fcn.0043634f
push 0x4a7e7c
lea ecx, [ebp - 0x2e4]
call fcn.00436db3
push ebx
lea eax, [ebp - 0x2e4]
mov ecx, edi
push eax
call fcn.0043630b
jmp 0x43ed17
mov eax, dword [ebp - 0x2c4]
mov ecx, edi
shr eax, 0x1d
and eax, 1
or eax, 0x3e8
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.004362eb
lea ecx, [ebp - 0x18]
call fcn.00438cda
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret
Function at 0x43ee07
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x43ee6a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x224]
push str.GetCurrentDirectory__
push eax
call fcn.00436a45
add esp, 0xc
mov ecx, esi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x224]
call fcn.0043634f
jmp 0x43ee9e
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00438d6a
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.00441275
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
call fcn.0043634f
push 0x4a4694
mov ecx, esi
call fcn.004362eb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret

Function at 0x43eeb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push 0x105
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x43ef13
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x224]
push str.GetSystemDirectory
push eax
call fcn.00436a45
add esp, 0xc
mov ecx, esi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x224]
call fcn.0043634f
jmp 0x43ef47
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00438d6a
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.00441275
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
call fcn.0043634f
push 0x4a4694
mov ecx, esi
call fcn.004362eb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret

Function at 0x43ef59
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x43efbc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x224]
push str.GetTempPath__
push eax
call fcn.00436a45
add esp, 0xc
mov ecx, esi
push eax
call fcn.0043630b
lea ecx, [ebp - 0x224]
call fcn.0043634f
jmp 0x43eff0
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00438d6a
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.00441275
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
call fcn.0043634f
push 0x4a4694
mov ecx, esi
call fcn.004362eb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret
Function at 0x43f0d2
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x28
call fcn.0043ae73
cmp eax, 0x3e8
je 0x43f116
push 0
push 0
push 0x64
push str.......SharedFileCommonECDirectory.cpp
lea eax, [ebp - 0x14]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x43f182
mov ecx, dword [ebp + 0xc]
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x43f175
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x28]
push str.RemoveDirectory__
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x28]
call fcn.0043634f
mov ecx, dword [ebp + 0xc]
call fcn.0043fcdc
push eax
lea eax, [ebp - 0x14]
push str.Unable_to_remove_directory___s_
push eax
call fcn.0043667d
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
jmp 0x43f103
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x43f606
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test eax, eax
jne 0x43f64c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.SetCurrentDirectory__
push eax
call fcn.00436a45
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x43f659
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x442677
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x4426d9
push edi
lea ecx, [ebp - 0x2c]
call fcn.004389d2
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x2c]
call fcn.00438cda
push edi
lea ecx, [ebp - 0x18]
call fcn.004389d2
push 0x498630
lea ecx, [ebp - 0x18]
call fcn.00438f73
lea ecx, [esi + 0x64]
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
call dword [eax + 8]
lea ecx, [ebp - 0x18]
call fcn.00438cda
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x442441
push 0
push 0
call fcn.0046f047
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x44275a
call fcn.0046dec4
cmp dword [eax], 0xb
jne 0x442708
mov edi, str.__too_many_threads_
jmp 0x44271d
call fcn.0046dec4
mov edi, str.__invalid_parameter_
mov ecx, 0x4a3da4
cmp dword [eax], 0x16
cmovne edi, ecx
call fcn.0046dec4
push edi
push dword [eax]
lea eax, [ebp - 0x10]
push 0xa8
push str.......SharedThreadsWin32ECThread.cpp
push 0
push eax
call fcn.0042bf8e
add esp, 0x10
mov ecx, eax
call fcn.0043fcdc
push eax
push str.Thread_was_not_created__errno___d_s.
call fcn.00441348
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0044145c
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.0046a6d5
mov esp, ebp
pop ebp
ret 4
Function at 0x442be7
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x64]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00442208
cmp dword [ebp - 8], 0
pop ecx
pop ecx
je 0x442d74
mov ecx, esi
call fcn.004425e4
cmp eax, 1
je 0x442c72
push eax
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x142
push str.......SharedThreadsWin32ECThread.cpp
push 0
push eax
call fcn.0042bf8e
add esp, 0x10
mov ecx, eax
call fcn.0043fcdc
push eax
push str.Thread___s__was_not_ready_to_run__state_d
call fcn.00441348
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0044145c
mov ecx, dword [ebp + 8]
push 0x4985fc
call fcn.004362eb
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x442d8d
call fcn.004074ed
jmp 0x442d8d
xor edi, edi
mov ebx, str.......SharedThreadsWin32ECThread.cpp
cmp dword [esi + 4], edi
jne 0x442ce5
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x147
push ebx
push edi
push eax
call fcn.0042bf8e
add esp, 0x10
mov ecx, eax
call fcn.0043fcdc
push eax
push str.Thread___s__handle_is_NULL
call fcn.00441348
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0044145c
cmp dword [esi + 4], edi
jne 0x442ce5
push edi
push edi
push 0x149
push ebx
push 0x4985f4
lea eax, [ebp - 0x1c]
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x1c]
call fcn.0043634f
jmp 0x442c5d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
test eax, eax
jne 0x442d01
push edi
push edi
push 0x14f
push ebx
push 0x4985f8
jmp 0x442cc3
cmp eax, 0xffffffff
jne 0x442d6d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
push eax
lea eax, [ebp - 0x30]
push 0x498910
push eax
call fcn.00436a45
add esp, 0xc
lea ecx, [ebp - 0x1c]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x30]
call fcn.0043634f
lea ecx, [ebp - 0x1c]
call fcn.0043fe40
cmp eax, 0x7d1
lea eax, [ebp - 0x1c]
push edi
jl 0x442ccf
push edi
push 0x151
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x30]
call fcn.0043634f
jmp 0x442cd8
mov dword [esi + 0x18], 2
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x442d80
call fcn.004074ed
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x442d99
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.004425e4
xor ebx, ebx
cmp eax, 2
jne 0x442db8
mov ecx, esi
call fcn.00442b24
jmp 0x442dcb
push dword [esi + 8]
push str.Thread___s__is_being_terminated__but_has_not_been_started.
push ebx
push ebx
push ebx
call fcn.00404b89
add esp, 0x14
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
test eax, eax
je 0x442e59
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x442df6
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00442e61
lea ecx, [ebp - 0x14]
call fcn.0043634f
push 0x7530
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x442e41
push str.Waiting_on_terminated_thread_failed
push 0x2c9
push str.......SharedThreadsWin32ECThread.cpp
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0042bf8e
add esp, 0x10
mov ecx, eax
call fcn.0043fcdc
push eax
push 0x4a46fc
call fcn.00441348
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0044145c
test edi, edi
je 0x442e58
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00442aec
lea ecx, [ebp - 0x14]
call fcn.0043634f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x443ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.0043ae73
cmp eax, 0x3e8
je 0x443b27
push 0
push 0
push 0x409
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x4aa638
push eax
call fcn.00407126
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x443b86
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x443b6f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.GetFileAttributes__
push eax
call fcn.00436a45
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x443b85
push esi
push eax
call fcn.00443a7c
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
pop esi
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x443c98
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.0043ae73
mov edi, 0x3e8
cmp eax, edi
jne 0x443d79
mov ecx, dword [ebp + 0x10]
call fcn.0043ae73
cmp eax, edi
jne 0x443d79
mov ecx, dword [ebp + 0x10]
call fcn.0043fcdc
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x443d72
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp edi, 3
jne 0x443d12
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
inc ebx
push eax
call fcn.00443934
pop ecx
pop ecx
mov byte [ebp - 1], bl
cmp dword [eax + 0xc], 0x3e9
je 0x443d16
mov byte [ebp - 1], 0
test bl, 1
je 0x443d23
lea ecx, [ebp - 0x1c]
call fcn.0043634f
cmp byte [ebp - 1], 0
je 0x443d5c
mov ecx, dword [ebp + 0x10]
push 0x498fa0
call fcn.0043b65a
cmp eax, 0x3e8
jne 0x443d5c
mov ecx, dword [ebp + 0x10]
call fcn.0043b037
inc eax
cmp eax, 0x104
jbe 0x443d5c
push 0x4accc0
mov ecx, dword [ebp + 8]
call fcn.004362eb
jmp 0x443da9
push 0
push edi
lea eax, [ebp - 0x1c]
push str.MoveFile__
push eax
call fcn.00436a45
add esp, 0xc
jmp 0x443d98
push 0x4a4694
jmp 0x443d52
push 0
push 0
push 0x374
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x1c]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x1c]
call fcn.0043634f
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443f40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.0043ae73
cmp eax, 0x3e8
je 0x443f87
push 0
push 0
push 0x354
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x443fc3
mov ecx, dword [ebp + 0xc]
call fcn.0043fcdc
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x443fb6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.DeleteFile__
push eax
call fcn.00436a45
add esp, 0xc
jmp 0x443f74
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x44410e
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
mov edi, ecx
call fcn.00443c67
lea ecx, [ebp - 0x14]
cmp dword [eax + 0xc], 0x3e9
setne bl
call fcn.0043634f
xor esi, esi
push esi
push esi
test bl, bl
je 0x44416d
push 0x2e3
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x4aa638
push eax
call fcn.00407126
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x14]
call fcn.0043634f
jmp 0x444218
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
mov ecx, edi
push dword [ebp + 0xc]
push eax
call fcn.00443fcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0043630b
lea ecx, [ebp - 0x28]
call fcn.0043634f
lea ecx, [ebp - 0x14]
call fcn.0043fe40
cmp eax, 0x7d1
jl 0x4441cd
push esi
push esi
push 0x2e7
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004069d9
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0043630b
lea ecx, [ebp - 0x28]
call fcn.0043634f
jmp 0x444160
lea ecx, [ebp - 0x14]
call fcn.0043634f
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x44420b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
push eax
lea eax, [ebp - 0x28]
push str.SetEndOfFile__
push eax
call fcn.00436a45
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0043630b
lea ecx, [ebp - 0x28]
jmp 0x444163
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x444224
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push edi
push eax
mov edi, ecx
call fcn.00443c67
lea ecx, [ebp - 0x18]
cmp dword [eax + 0xc], 0x3e9
setne bl
call fcn.0043634f
push 0
test bl, bl
je 0x44427f
push 0
push 0x1ec
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x18]
push 0x4aa638
push eax
call fcn.00407126
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0043630b
lea ecx, [ebp - 0x18]
call fcn.0043634f
jmp 0x4442dd
cmp dword [ebp + 0x10], 0xffffffff
jbe 0x44428e
push 0
push 0x1f2
jmp 0x444256
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4442c4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x18]
push str.WriteFile__
push eax
call fcn.00436a45
add esp, 0xc
jmp 0x44426c
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4442d0
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
push 0x4a4694
call fcn.004362eb
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10