joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f790
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x694], 0
je 0x46f7ff
cmp dword [ebp + 8], 0x100
jne 0x46f7ef
cmp word [ebp + 0xc], 0xd
jne 0x46f7ef
cmp byte [esi + 0x69a], 0
je 0x46f7ce
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46f7ef
cmp byte [esi + 0x69b], 0
jne 0x46f7ef
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x46f7e8
push 1
push 0
push 0
push 0
push str.return
push esi
call fcn.0045d060
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x694]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x46fc90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5a9464]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x46fd8a
movzx eax, word [ebx]
test ax, ax
je 0x46fd8a
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x46fcd0
cmp ax, 0x5c
jne 0x46fcd2
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x46fcc4
cmp edi, ebx
je 0x46fd1f
sub edi, ebx
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push ebx
push eax
call fcn.00531897
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x46fd9a
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0046fc90
add esp, 8
lea ecx, [ebp - 0x414]
sub ecx, esi
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x46fd30
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x46fd42
lea edi, [ebp - 0x414]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x46fd60
mov ecx, ebx
lea eax, [ebp - 0x414]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00508d84
mov esp, ebp
pop ebp
ret
call fcn.00509aaa
int3

Function at 0x470480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x470519
cmp dword [esi + 4], 0xffffffff
jne 0x470519
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4704b0
cmp dword [ebp + 0x10], 1
mov eax, dword [0x58d0dc]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x4704e3
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4704e3
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00472e00
add esp, 0x10
test eax, eax
jne 0x470503
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.00473640
add esp, 4
mov dword [esi], eax
mov eax, dword [0x5ae230]
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4ea310
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4ea33b
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4ea32a
pop edi
xor eax, eax
pop esi
ret
push dword [eax + 8]
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call ecx
jmp 0x4ea370
cmp dword [esi + 8], 0
jne 0x4ea35e
push 0x590ee4
push dword [eax + 8]
call fcn.0052672d
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4ea35e
pop edi
or eax, 0xffffffff
pop esi
ret
push dword [esi + 8]
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call fcn.0052a0da
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4ea392
mov eax, dword [esi + 8]
test eax, eax
je 0x4ea38c
push eax
call fcn.00526801
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x4ee690
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4ee6a0
sub esi, ecx
lea ebp, [esi + esi]
push ebp
call dword [0x5a9360]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ee6c7
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ecx, ecx
test esi, esi
je 0x4ee6e0
nop dword [eax]
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x4ee6d0
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [esp + 0x28]
test eax, eax
je 0x4ee75a
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4ee74e
push 0
push ebp
push edi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x5a9364]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0xc185484a
sub eax, 0xc1452be4
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x46e4ced
add dword [ebp - 0x2c], 0x49e3f85e
mov dword [ebp - 0x28], 0x7d5b061b
add dword [ebp - 0x28], 0xb4d8462a
mov dword [ebp - 0x24], 0xa0a2f2af
add dword [ebp - 0x24], 0xaba9517f
mov dword [ebp - 0x20], 0xa1186b78
add dword [ebp - 0x20], 0x5ee79488
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xf6bba753
sub eax, 0xf67b76ff
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x12523857
add dword [ebp - 0x2c], 0x622030ff
mov dword [ebp - 0x28], 0x1f4fbb87
add dword [ebp - 0x28], 0x221ca5ee
mov dword [ebp - 0x24], 0x535fafe0
sub dword [ebp - 0x24], 0xeff04374
mov dword [ebp - 0x20], 0x3820f225
add dword [ebp - 0x20], 0xc7df0ddb
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3940a
push 0
call eax
mov ecx, 0x14ffdf40
add ecx, 0xeb0073d6
mov edx, eax
mov esi, 0x2f058b06
sub esi, 0x2ec51b06
add esi, dword [ebp - 0x1c]
mov ebx, 0x75aa08bf
mov dword [ebp - 0x18], 0xee1b32f5
mov edi, dword [esi]
add dword [ebp - 4], 0xf562b746
xor edi, ebx
add dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 8], 0x4d4fc9db
add edx, 0xa9acf0ef
add edx, 0x56530f15
add esi, 0x745662d5
sub esi, 0x745662d1
loop 0x401d7d
add eax, 0x13f2b
mov ebx, eax
add eax, 0x48f4fe9c
add eax, 0xb70b0169
mov ecx, 0x26c9d631
sub ecx, 0x2689d631
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4010a0
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov byte [ebp - 9], 0
push edi
mov ebx, edx
cmp dword [esi + 0x14], 0x10
jb 0x4010c5
mov eax, dword [esi]
jmp 0x4010c7
mov eax, esi
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40112a
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x14], 0x10
jb 0x40110e
mov esi, dword [esi]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040ac78
mov esp, ebp
pop ebp
ret

Function at 0x401820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423bca
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.0040bcb8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4018e0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0040e1c7
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x433ffc
push eax
call fcn.0040e734
push edi
push esi
call fcn.0040c000
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret 4
Function at 0x403150
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423f22
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x21c], esi
mov dword [esi + 0x10], 0
jb 0x4031ba
mov eax, dword [esi]
jmp 0x4031bc
mov eax, esi
mov byte [eax], 0
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x214], 1
call fcn.0040e7b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x40322d
cmp byte [ebp - 0x210], 0
jne 0x40320c
xor ecx, ecx
jmp 0x40321e
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403215
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.00401150
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x403370
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423fc2
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x214], 0
jb 0x4033cc
mov eax, dword [esi]
jmp 0x4033ce
mov eax, esi
lea ecx, [ebp - 0x214]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [edi + 0x10], 0
mov ecx, eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x224], ecx
mov dword [edi + 0x10], 0
jb 0x40340a
mov eax, dword [edi]
jmp 0x40340c
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x220], 1
test ecx, ecx
je 0x4034fb
push ecx
push 2
mov dword [ebp - 0x218], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x228], eax
jb 0x403452
mov esi, dword [esi]
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x214]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x431454
push dword [ebp - 0x228]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov eax, dword [ebp - 0x21c]
mov si, word [eax + 0xa]
mov dx, word [eax + 8]
mov cx, word [eax + 0xe]
mov ax, word [eax + 0xc]
movzx eax, ax
push eax
movzx eax, cx
push eax
movzx eax, dx
push eax
movzx eax, si
push eax
lea eax, [ebp - 0x210]
push str._d._d._d._d
push eax
call fcn.0040ac60
add esp, 0x18
cmp byte [ebp - 0x210], 0
jne 0x4034cc
xor ecx, ecx
jmp 0x4034de
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4034d5
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.00401150
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x403520
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor bl, bl
cmp dword [ecx + 0x14], 0x10
push edi
mov edi, edx
jb 0x403542
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4035f9
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x408], 0x400
push 0
push eax
call fcn.0040e7b0
add esp, 0xc
lea eax, [ebp - 0x408]
push 0
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5a4d
xor cl, cl
cmp word [ebp - 0x404], ax
jne 0x4035e6
mov eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x408]
jge 0x4035e6
cmp dword [ebp + eax - 0x404], 0x4550
jne 0x4035e6
mov eax, dword [ebp + eax - 0x3fc]
mov cl, 1
mov dword [edi], eax
mov dword [edi + 4], 0
pop edi
pop esi
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x403700
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424019
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x50], edi
mov dword [edi + 0x10], 0
jb 0x403763
mov eax, dword [edi]
jmp 0x403765
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 4], 0
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x2c], 1
nop
mov edx, esi
lea ecx, [ebp - 0x48]
call fcn.004025b0
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
push eax
mov dword [ebp - 4], 1
call fcn.00409d50
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x4037ea
mov ecx, dword [ebp - 0x48]
inc eax
cmp eax, 0x1000
jb 0x4037e1
test cl, 0x1f
jne 0x4038b2
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4038b2
sub ecx, eax
cmp ecx, 4
jb 0x4038b2
cmp ecx, 0x23
ja 0x4038b2
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x80
cmovae eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
lea eax, [ebp - 0x28]
je 0x4038d9
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
jne 0x403884
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x403878
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x40386f
test cl, 0x1f
jne 0x4038b2
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4038b2
sub ecx, eax
cmp ecx, 4
jb 0x4038b2
cmp ecx, 0x23
ja 0x4038b2
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
inc esi
cmp esi, 0x64
jl 0x403780
jmp 0x4038ea
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x40389a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004012e0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4038ea
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x4038e1
test cl, 0x1f
je 0x4038b7
call fcn.00411091
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4038c3
call fcn.00411091
sub ecx, eax
cmp ecx, 4
jae 0x4038cf
call fcn.00411091
cmp ecx, 0x23
jbe 0x4038df
call fcn.00411091
cmp edi, eax
je 0x40389a
jmp 0x40388b
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x403910
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x14], 0x10
jb 0x403930
mov eax, dword [esi]
jmp 0x403932
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4039ee
cmp dword [esi + 0x14], 0x10
jb 0x40394b
mov eax, dword [esi]
jmp 0x40394d
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [esi + 0x14], 0x10
jb 0x403963
mov eax, dword [esi]
jmp 0x403965
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4039ee
mov edx, esi
lea ecx, [ebp - 0x1c]
call fcn.00403700
cmp dword [ebp - 0xc], 0
jbe 0x4039d4
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
cmp dword [esi + 0x14], 0x10
jb 0x403993
mov esi, dword [esi]
push 3
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call esi
test eax, eax
movzx ebx, bl
mov ecx, 1
lea eax, [ebp - 0x1c]
cmovne ebx, ecx
cmp dword [ebp - 8], 0x10
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4039d4
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 0x1c]
push 4
cmovae ecx, dword [ebp - 0x1c]
push 0
push ecx
call esi
lea ecx, [ebp - 0x1c]
call fcn.00405ff0
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
Function at 0x404180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4240c2
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x124], esi
mov dword [esi + 0x10], 0
jb 0x4041ea
mov eax, dword [esi]
jmp 0x4041ec
mov eax, esi
mov byte [eax], 0
push 0x104
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x11c], 1
call fcn.0040e7b0
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x118], 0
jne 0x404235
xor ecx, ecx
jmp 0x404249
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404240
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.00401150
cmp dword [esi + 0x10], 3
jb 0x404283
push 3
push 0
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
call fcn.00405fb0
push eax
mov ecx, esi
call fcn.00406060
lea ecx, [ebp - 0x13c]
call fcn.00405ff0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ac78
mov esp, ebp
pop ebp
ret

Function at 0x4042a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x23c]
call fcn.00404180
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0040e7b0
add esp, 0xc
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x228], 0x10
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push 0x103
push ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0x103
lea ecx, [ebp - 0x110]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [ebp - 0x21c]
test eax, eax
mov eax, dword [ebp - 0x228]
mov ecx, 0x556724c
cmove esi, ecx
mov dword [ebp - 0x21c], esi
cmp eax, 0x10
jb 0x40436f
mov ecx, dword [ebp - 0x23c]
inc eax
cmp eax, 0x1000
jb 0x404366
test cl, 0x1f
jne 0x404380
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x404385
sub ecx, eax
cmp ecx, 4
jb 0x40438a
cmp ecx, 0x23
ja 0x40438f
mov ecx, eax
push ecx
call fcn.0040acbc
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040ac78
mov esp, ebp
pop ebp
ret
call fcn.00411091
call fcn.00411091
call fcn.00411091
call fcn.00411091
int3
Function at 0x404d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp dword [esi + 0x14], 0x10
jb 0x404dab
mov eax, dword [esi]
jmp 0x404dad
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x404dd5
cmp dword [esi + 0x14], 0x10
jb 0x404dc0
mov esi, dword [esi]
push esi
push str.file__s_not_exist__need_install
call fcn.00403050
add esp, 8
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 8]
mov ecx, esi
call fcn.00403520
test al, al
jne 0x404e00
cmp dword [esi + 0x14], 0x10
jb 0x404deb
mov esi, dword [esi]
push esi
push str.file__s_get_time_error__need_install
call fcn.00403050
add esp, 8
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
jl 0x404e2f
jg 0x404e12
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jbe 0x404e2f
cmp dword [esi + 0x14], 0x10
jb 0x404e1a
mov esi, dword [esi]
push esi
push str.file__s_time_old__need_install
call fcn.00403050
add esp, 8
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.file_not_update
call fcn.00402ce0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret