joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40efb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov cl, byte [esi + 0x11c]
lea eax, [esi + 0xc]
test cl, cl
jne 0x40efd7
mov eax, dword [esi + 8]
cmp word [eax + 6], 0x3a
jne 0x40f06f
lea eax, [esi + 0xc]
test cl, cl
jne 0x40efec
mov eax, dword [esi + 8]
cmp word [eax + 8], 0
jne 0x40f06f
push esi
lea ecx, [ebp - 0x24c]
call fcn.00403530
push 0x4f5628
lea eax, [ebp - 0x24c]
push 0x4fc47c
push eax
call fcn.004048f0
add esp, 0xc
lea eax, [ebp - 0x240]
cmp byte [ebp - 0x130], 0
cmove eax, dword [ebp - 0x244]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40f041
xor bl, bl
jmp 0x40f047
shr ebx, 4
and bl, 1
cmp byte [ebp - 0x130], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x40f190
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
jmp 0x40f183
push esi
lea ecx, [ebp - 0x128]
call fcn.00403530
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x40f08b
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x40f0b4
lea ecx, [esi + 0xc]
test al, al
jne 0x40f09c
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x40f0b4
lea ecx, [esi + 0xc]
test al, al
jne 0x40f0ad
mov ecx, dword [esi + 8]
cmp word [ecx + 0xa], 0
je 0x40f0fc
push edi
mov edi, dword [esi + 4]
test edi, edi
je 0x40f0fb
test al, al
lea eax, [esi + 0xc]
jne 0x40f0c6
mov eax, dword [esi + 8]
cmp word [eax + edi*2 + 2], 0x5c
jne 0x40f0fb
lea eax, [edi - 1]
push edi
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x124], eax
call fcn.004056f0
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
xor ecx, ecx
mov word [eax + edi*2 + 2], cx
pop edi
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40f122
xor bl, bl
jmp 0x40f167
mov al, byte [esi + 0x11c]
lea ecx, [esi + 0xc]
test al, al
jne 0x40f132
mov ecx, dword [esi + 8]
cmp word [ecx + 6], 0x3a
jne 0x40f161
lea ecx, [esi + 0xc]
test al, al
jne 0x40f143
mov ecx, dword [esi + 8]
cmp word [ecx + 8], 0x5c
jne 0x40f161
test al, al
je 0x40f153
add esi, 0xc
jmp 0x40f156
mov esi, dword [esi + 8]
cmp word [esi + 0xa], 0
jne 0x40f161
mov bl, 1
jmp 0x40f167
shr ebx, 4
and bl, 1
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x40f190
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x40f190
push eax
call fcn.00496f41
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x40f3a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfb3b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x16c], eax
lea eax, [esi + 0xc]
jne 0x40f3e7
mov eax, dword [esi + 8]
push 0
push 0x80
push 3
push 0
push 7
push 0x100
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f421
mov edi, dword [ebp - 0x16c]
mov ecx, edi
push 0x4fd0b4
call fcn.004058b0
jmp 0x40f4bf
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x44]
movq qword [ebp - 0x174], xmm0
push eax
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.004dc889
mov eax, dword [ebp - 0x30]
add esp, 8
add eax, 0x76c
mov word [ebp - 0x20], ax
mov eax, dword [ebp - 0x34]
inc eax
mov word [ebp - 0x1e], ax
movzx eax, word [ebp - 0x38]
mov word [ebp - 0x1a], ax
movzx eax, word [ebp - 0x2c]
mov word [ebp - 0x1c], ax
movzx eax, word [ebp - 0x3c]
mov word [ebp - 0x18], ax
movzx eax, word [ebp - 0x40]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 0x44]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x174]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
test eax, eax
jne 0x40f530
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x16c]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40f4ce
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x168]
add eax, 4
push 0
push eax
call fcn.0040e650
lea eax, [ebp - 0x168]
mov dword [ebp - 4], 0
push eax
push 0x4fd0c4
mov ecx, edi
call fcn.00427350
mov ecx, eax
call fcn.00427740
cmp byte [ebp - 0x4c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x40f52c
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
cmp eax, ecx
je 0x40f52c
push eax
call fcn.00496f41
add esp, 4
xor al, al
jmp 0x40f538
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fac0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfc9b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
mov ebx, dword [ebp + 8]
jne 0x40fb02
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40fb20
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40fbd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 0x11c], 0
mov edi, eax
lea eax, [esi + 0xc]
jne 0x40fb49
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40fbd3
shr eax, 4
not al
and al, 1
je 0x40fbd3
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40fb70
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x134]
add eax, 4
push 0
push eax
call fcn.0040e650
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 0
push eax
push 0x4fd11c
push edi
mov ecx, ebx
call fcn.004272c0
mov ecx, eax
call fcn.00427740
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x40fbcf
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x40fbcf
push eax
call fcn.00496f41
add esp, 4
xor al, al
jmp 0x40fbd5
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410100
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfd26
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
call fcn.0040efb0
test al, al
je 0x410143
mov al, 1
jmp 0x4102ec
lea ecx, [ebp - 0x134]
call fcn.00403480
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004056f0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00410b30
test al, al
je 0x410207
cmp dword [ebp - 0x130], 2
jb 0x4101f1
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
test bl, bl
cmove eax, ecx
movzx edx, word [eax + 6]
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 8]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x128]
cmove eax, ecx
movzx eax, word [eax + 0xa]
cmp edx, 0x3a
jne 0x4101f1
cmp word [ebp - 0x25c], 0x5c
jne 0x4101f1
test ax, ax
je 0x410207
push 0
push edi
lea ecx, [ebp - 0x134]
call fcn.00410100
test al, al
je 0x410292
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x410216
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x410296
cmp byte [esi + 0x11c], al
lea eax, [esi + 0xc]
jne 0x410234
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x258]
add eax, 4
push 0
push eax
call fcn.0040e650
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 2
push eax
push 0x4fd1a8
mov ecx, edi
call fcn.00427350
mov ecx, eax
call fcn.00427740
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x410292
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x410292
push eax
call fcn.00496f41
add esp, 4
xor bl, bl
jmp 0x4102c1
cmp byte [esi + 0x11c], 0
lea ecx, [esi + 0xc]
jne 0x4102a5
mov ecx, dword [esi + 8]
push 1
push ecx
add ecx, 4
mov edx, 1
call fcn.004353a0
add esp, 8
mov ecx, esi
call fcn.00412b40
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4102ea
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
cmp ecx, eax
je 0x4102ea
push ecx
call fcn.00496f41
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 8
Function at 0x4104b0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dfdc1
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x134]
mov esi, dword [ebp + 0xc]
call fcn.00403480
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004056f0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
cmove eax, dword [ebp - 0x12c]
xor ecx, ecx
mov word [eax + 4], cx
lea eax, [ebp - 0x134]
mov dword [ebp - 4], ecx
push eax
mov ecx, esi
call fcn.00410b30
test al, al
je 0x410550
push ecx
push ebx
lea ecx, [ebp - 0x134]
call fcn.00410100
test al, al
je 0x41066b
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41055f
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41057d
mov eax, dword [esi + 8]
cmp byte [edi + 0x11c], 0
lea ecx, [edi + 0xc]
jne 0x41058c
mov ecx, dword [edi + 8]
push 0
add eax, 4
push eax
lea eax, [ecx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41066f
mov ecx, ebx
call fcn.00427350
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4105ba
mov eax, dword [esi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x37c]
add eax, 4
push 0
push eax
call fcn.0040e650
mov byte [ebp - 4], 1
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x4105e1
mov eax, dword [edi + 8]
sub esp, 0x10
lea ecx, [ebp - 0x258]
add eax, 4
push 0
push eax
call fcn.0040e650
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
push 0x4fd200
call fcn.0040e2a0
cmp byte [ebp - 0x13c], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41063f
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x41063f
push eax
call fcn.00496f41
add esp, 4
cmp byte [ebp - 0x260], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41066b
mov eax, dword [ebp - 0x374]
lea ecx, [ebp - 0x370]
cmp eax, ecx
je 0x41066b
push eax
call fcn.00496f41
add esp, 4
xor bl, bl
jmp 0x4106b8
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x41067e
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea ecx, [esi + 0xc]
jne 0x41069c
mov ecx, dword [esi + 8]
push 1
push ecx
add ecx, 4
mov edx, 1
call fcn.004353a0
add esp, 8
mov ecx, esi
call fcn.00412b40
mov bl, 1
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4106e1
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4106e1
push eax
call fcn.00496f41
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e045b
mov eax, dword fs:[0]
push eax
sub esp, 0x92c
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0x10
lea ecx, [ebp - 0x934]
push 0
push edi
call fcn.0040e650
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 0xffffffff
je 0x4154be
shr eax, 4
not al
and al, 1
jne 0x4155e7
lea ecx, [ebp - 0x934]
call fcn.0040efb0
test al, al
jne 0x4154d4
xor esi, esi
jmp 0x4155f0
push edi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.0041cc50
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x530588
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4155e7
nop word [eax + eax]
mov edx, 0x4f562c
mov ecx, 0x5305b4
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x415546
test ax, ax
je 0x415542
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x415546
add ecx, 4
add edx, 4
test ax, ax
jne 0x415520
xor eax, eax
jmp 0x41554b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4155cc
mov eax, 0x4fdaa0
mov ecx, 0x5305b4
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x415586
test dx, dx
je 0x415582
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x415586
add ecx, 4
add eax, 4
test dx, dx
jne 0x415560
xor eax, eax
jmp 0x41558b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4155cc
push 0x5305b4
push edi
lea eax, [ebp - 0x810]
push 0x4fdb58
push eax
call fcn.0041cc50
add esp, 0x10
test byte [0x530588], 0x10
je 0x4155bf
lea ecx, [ebp - 0x810]
call fcn.00415440
jmp 0x4155cc
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call ebx
push 0x530588
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415510
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
push 0
push edi
call ebx
mov esi, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41561c
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x41561c
push eax
call fcn.00496f41
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x415700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e04b1
mov eax, dword fs:[0]
push eax
sub esp, 0xa58
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0xa59], dl
mov esi, ecx
call fcn.00415640
test al, al
jne 0x415746
xor eax, eax
jmp 0x41594f
sub esp, 0x10
lea ecx, [ebp - 0x934]
xor ebx, ebx
push ebx
push esi
call fcn.0040e650
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], bl
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415802
shr eax, 4
not al
and al, 1
je 0x415802
sub esp, 0x10
lea ecx, [ebp - 0xa58]
push ebx
push esi
call fcn.0040e650
mov byte [ebp - 0xa60], bl
mov dword [ebp - 0xa64], ebx
sub esp, 8
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa64]
lea ecx, [ebp - 0xa58]
push eax
call fcn.0040fac0
lea ecx, [ebp - 0xa64]
call fcn.00426230
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
cmp byte [ebp - 0x93c], bl
jne 0x415921
mov eax, dword [ebp - 0xa50]
lea ecx, [ebp - 0xa4c]
cmp eax, ecx
je 0x415921
push eax
call fcn.00496f41
add esp, 4
jmp 0x415921
lea ecx, [ebp - 0x934]
call fcn.0040efb0
test al, al
jne 0x415818
xor ebx, ebx
jmp 0x415921
push esi
lea eax, [ebp - 0x810]
push str._s.
push eax
call fcn.0041cc50
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x52fd68
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41590f
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, 0x4f562c
mov ecx, 0x52fd94
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x415886
test ax, ax
je 0x415882
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x415886
add ecx, 4
add edx, 4
test ax, ax
jne 0x415860
xor eax, eax
jmp 0x41588b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4158f6
mov ecx, 0x4fdaa0
mov eax, 0x52fd94
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4158c6
test dx, dx
je 0x4158c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4158c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4158a0
xor eax, eax
jmp 0x4158cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4158f6
push 0x52fd94
push esi
lea eax, [ebp - 0x810]
push 0x4fdb58
push eax
call fcn.0041cc50
add esp, 0x10
lea ecx, [ebp - 0x810]
mov dl, 1
call fcn.00415700
push 0x52fd68
push edi
call ebx
test eax, eax
jne 0x415850
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
cmp byte [ebp - 0xa59], 0
je 0x415921
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41594d
mov ecx, dword [ebp - 0x92c]
lea eax, [ebp - 0x928]
cmp ecx, eax
je 0x41594d
push ecx
call fcn.00496f41
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x416df0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 4], 0
push edi
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
push ecx
push eax
mov edi, edx
mov dword [ebp - 8], 0
xor bl, bl
mov dword [ebp - 0x10], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x416e30
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004a9943
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x416eb1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4f5628
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x416eb1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
movzx eax, word [ecx + 0xa]
mov word [edi], ax
movzx eax, word [ecx + 8]
mov word [edi + 2], ax
movzx eax, word [ecx + 0xe]
mov word [edi + 4], ax
movzx eax, word [ecx + 0xc]
mov word [edi + 6], ax
test edx, edx
je 0x416eaf
movzx eax, word [ecx + 0x12]
mov word [edx], ax
movzx eax, word [ecx + 0x10]
mov word [edx + 2], ax
movzx eax, word [ecx + 0x16]
mov word [edx + 4], ax
movzx eax, word [ecx + 0x14]
mov word [edx + 6], ax
mov bl, 1
test esi, esi
je 0x416ebe
push esi
call fcn.00496f41
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.0048bb90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x416f27
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret
push str.kernel32.dll
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004b5238
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x20c]
call fcn.00416df0
add esp, 0x10
test al, al
je 0x416f15
movzx eax, word [ebp - 0x214]
mov dword [edi + 4], eax
movzx eax, word [ebp - 0x212]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x210]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi], 0x114
mov dword [edi + 0x10], 2
mov word [edi + 0x14], ax
test esi, esi
je 0x416fc2
movzx eax, word [ebp - 0x21c]
mov dword [esi + 4], eax
movzx eax, word [ebp - 0x21a]
mov dword [esi + 8], eax
movzx eax, word [ebp - 0x218]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], ax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00489940
mov esp, ebp
pop ebp
ret
Function at 0x417ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e07bb
mov eax, dword fs:[0]
push eax
sub esp, 0x934
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x93c], edx
mov ebx, ecx
sub esp, 0x10
lea ecx, [ebp - 0x934]
push 0
push ebx
call fcn.0040e650
mov dword [ebp - 4], 0
lea eax, [ebp - 0x928]
cmp byte [ebp - 0x818], 0
cmove eax, dword [ebp - 0x92c]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41806e
shr eax, 4
not al
and al, 1
jne 0x418186
lea ecx, [ebp - 0x934]
call fcn.0040efb0
test al, al
je 0x4181f7
push ebx
push str._s.
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.004143b0
add esp, 0x10
lea eax, [ebp - 0x810]
push 0x530a30
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x418186
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov edx, 0x4f562c
mov ecx, 0x530a5c
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4180f6
test ax, ax
je 0x4180f2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x4180f6
add ecx, 4
add edx, 4
test ax, ax
jne 0x4180d0
xor eax, eax
jmp 0x4180fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x41816f
mov eax, 0x4fdaa0
mov ecx, 0x530a5c
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x418136
test dx, dx
je 0x418132
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x418136
add ecx, 4
add eax, 4
test dx, dx
jne 0x418110
xor eax, eax
jmp 0x41813b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41816f
push 0x530a5c
push ebx
push 0x4fdb58
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.004143b0
mov edx, dword [ebp - 0x93c]
lea ecx, [ebp - 0x810]
add esp, 0x14
call fcn.00417ff0
push 0x530a30
push esi
call edi
test eax, eax
jne 0x4180c0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x4181f7
mov edi, ebx
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x418190
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 5]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004899b7
push str.___
mov esi, eax
push 5
push esi
mov dword [ebp - 0x940], esi
call fcn.004b5162
push ebx
lea edx, [edi + 1]
push edx
lea eax, [esi + 8]
push eax
call fcn.004b5162
mov ecx, dword [ebp - 0x93c]
xor eax, eax
add esp, 0x1c
mov word [esi + edi*2 + 8], ax
lea eax, [ebp - 0x940]
push eax
call fcn.0041bdf0
cmp byte [ebp - 0x818], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x418223
mov eax, dword [ebp - 0x92c]
lea ecx, [ebp - 0x928]
cmp eax, ecx
je 0x418223
push eax
call fcn.00496f41
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret