joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4181c8
Capabilities:
Check if file exists
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c34ce
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x50e7dc]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
push edi
mov eax, dword [0x50e7dc]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x17]
push eax
call fcn.00477398
xor ebx, ebx
push str.CFirefoxBrowser::ShowToolband___start__bShow:
lea ecx, [esp + 0x40]
mov dword [esp + 0x11c], ebx
call fcn.00404bd0
cmp byte [ebp + 8], 1
mov byte [esp + 0x118], 1
sete al
movzx eax, al
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00401927
pop ecx
pop ecx
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x44]
mov byte [esp + 0x120], bl
call fcn.004058b3
cmp byte [edi + 0x90], bl
je 0x4182cb
push str.CFirefoxBrowser::ShowToolband___Firefox_is_running.
lea ecx, [esp + 0x40]
call fcn.00404bd0
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x11c], 2
call fcn.004017f5
pop ecx
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.004058b3
push 0x15
pop esi
or dword [esp + 0x118], 0xffffffff
call fcn.004773de
mov eax, esi
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.0049f533
mov esp, ebp
pop ebp
ret 4
push ebx
lea ecx, [esp + 0x5c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x74], 7
call fcn.00405ece
mov byte [esp + 0x118], 3
xor edi, edi
jmp 0x4183a7
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x78]
call fcn.0042b45c
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x78]
mov byte [esp + 0x11c], 4
call fcn.0042ce28
mov byte [esp + 0x118], 5
cmp dword [esp + 0x54], 8
mov eax, dword [esp + 0x40]
jae 0x41832b
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41836a
push str.CFirefoxBrowser::ShowToolband___Error_file_not_found:
lea ecx, [esp + 0x24]
call fcn.00404bd0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x120], 6
call fcn.00401985
pop ecx
pop ecx
push ebx
push esi
lea ecx, [esp + 0x28]
call fcn.004058b3
jmp 0x418389
push dword [ebp + 8]
lea eax, [esp + 0x40]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00404bf2
call fcn.004183fe
cmp al, bl
jne 0x41838b
mov edi, esi
push ebx
push esi
lea ecx, [esp + 0x44]
call fcn.004058b3
lea ecx, [esp + 0x74]
mov byte [esp + 0x118], 3
call fcn.0042b4e1
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0042b7fb
pop ecx
pop ecx
test al, al
jne 0x4182f0
push str.CFirefoxBrowser::ShowToolband___end
lea ecx, [esp + 0x24]
call fcn.00404bd0
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x11c], 7
call fcn.004017f5
pop ecx
push ebx
push esi
lea ecx, [esp + 0x28]
call fcn.004058b3
push ebx
push esi
lea ecx, [esp + 0x60]
call fcn.004058b3
mov esi, edi
jmp 0x418296
Function at 0x41cada
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x4be0a6
call fcn.0049f542
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], edi
call fcn.0041beb2
xor ebx, ebx
inc ebx
xor esi, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 0xc], edi
je 0x41cc2e
mov eax, dword [ebp + 8]
dec dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp + esi - 0x10], al
inc esi
inc dword [ebp + 8]
cmp esi, 3
jne 0x41cb80
mov al, byte [ebp - 0x10]
mov cl, byte [ebp - 0xf]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xf]
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx edi, byte [ebp + esi - 0x14]
mov eax, 0x5123f0
call fcn.0041ce0e
mov al, byte [eax]
mov edi, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
call fcn.0041ce74
inc esi
cmp esi, 4
jl 0x41cb57
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x41cb09
cmp esi, edi
je 0x41cc2e
cmp esi, 3
jge 0x41cba6
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.0049f650
add esp, 0xc
mov cl, byte [ebp - 0x10]
mov al, cl
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0xf]
and cl, 3
mov dl, al
shl cl, 4
shr dl, 4
add cl, dl
mov byte [ebp - 0x13], cl
mov cl, byte [ebp - 0xe]
and al, 0xf
mov dl, cl
shl al, 2
shr dl, 6
add al, dl
mov byte [ebp - 0x12], al
and cl, 0x3f
lea eax, [esi + 1]
cmp eax, edi
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edi
jle 0x41cc13
mov eax, dword [ebp - 0x10]
movzx edi, byte [ebp + eax - 0x14]
mov eax, 0x5123f0
call fcn.0041ce0e
mov al, byte [eax]
mov edi, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
call fcn.0041ce74
inc dword [ebp - 0x10]
lea eax, [esi + 1]
cmp dword [ebp - 0x10], eax
jl 0x41cbe6
push 3
pop eax
cmp esi, eax
jge 0x41cc2e
sub eax, esi
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 0x18]
push 0x3d
call fcn.0041ce74
dec dword [ebp - 0x14]
jne 0x41cc1f
mov eax, dword [ebp - 0x18]
call fcn.0049f61a
ret 8
Function at 0x41d14b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bf77f
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x50e7dc]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x50e7dc]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
push str.CUnInstallerHelper::CloseVProtector___Sending_vprot.exe_WM_QUIT
lea ecx, [esp + 0x18]
call fcn.00404bd0
lea eax, [esp + 0x14]
xor edi, edi
push eax
mov dword [esp + 0x9c], edi
call fcn.004017f5
or dword [esp + 0x9c], 0xffffffff
pop ecx
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [esp + 0x1c]
call fcn.004058b3
push str.GlobalVprotEventForWmClose
lea ecx, [esp + 0x18]
call fcn.00404bd0
mov dword [esp + 0x98], ebx
mov dword [esp + 0x54], edi
lea eax, [esp + 0x14]
mov byte [esp + 0x98], 2
push eax
lea ecx, [esp + 0x60]
mov dword [esp + 0x50], vtable.CThreadPostMsgOnEvent.0
mov dword [esp + 0x5c], edi
call fcn.00404bf2
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
push edi
push ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa0], 4
call fcn.004058b3
lea esi, [esp + 0x4c]
call fcn.00477737
mov dword [esp + 0x58], eax
cmp eax, edi
je 0x41d273
push str.CThreadPostMsgOnEvent::Execute_____set_event
lea ecx, [esp + 0x34]
call fcn.00404bd0
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x9c], 5
call fcn.004017f5
pop ecx
push edi
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 4
call fcn.004058b3
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, str.vprot.exe
push 0xa
mov ecx, esi
call fcn.00402cce
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x41d2d8
push str.CUnInstallerHelper::CloseVProtector___WM_QUIT_didnt_work_10_sec._try_to_kill.
lea ecx, [esp + 0x34]
call fcn.00404bd0
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x9c], 6
call fcn.004017f5
pop ecx
push edi
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0xa0], 4
call fcn.004058b3
push edi
push 0x41d309
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xa
mov ecx, esi
call fcn.00402cce
pop ecx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x4c]
call fcn.00477657
cmp dword [esp + 0x10], ebx
setne al
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.0049f533
mov esp, ebp
pop ebp
ret
Function at 0x41fdcd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x50e7dc]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x120
mov eax, 0x4bf5e4
call fcn.0049f542
mov esi, 0x104
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers_
lea eax, [ebp + 0x1c]
push esi
push eax
call fcn.004a27ee
add esp, 0xc
lea eax, [ebp + 0x1c]
mov esi, 0x5106c4
push eax
mov ecx, esi
call fcn.00404e03
call fcn.004048e9
test eax, eax
je 0x41fe36
push str.avgtpx64.sys
jmp 0x41fe3b
push str.avgtpx86.sys
push esi
call fcn.0041c045
cmp dword [0x5106dc], 0x10
mov eax, dword [0x5106c8]
jae 0x41fe54
mov eax, 0x5106c8
push eax
lea ecx, [ebp - 0x12c]
call fcn.0041c01b
and dword [ebp - 4], 0
push dword [eax]
lea ecx, [ebp]
call fcn.00404bd0
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x12c], eax
je 0x41fe8c
push dword [ebp - 0x12c]
call fcn.0049f900
pop ecx
push str.CDriverHelper::SetPath___path
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00401985
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004058b3
push 0
push 1
lea ecx, [ebp]
call fcn.004058b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0049f533
add ebp, 0x124
leave
ret
Function at 0x424dbb
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x54
push 0x108
mov eax, 0x4c19cb
call fcn.0049f542
mov eax, dword [ebp + 0x60]
cmp byte [eax + 0x3c], 0
jne 0x424ec9
lea eax, [ebp]
push str.APPDATA
push eax
call fcn.0040479d
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x18], 8
jb 0x424dfb
mov eax, dword [eax + 4]
jmp 0x424dfe
add eax, 4
push 3
push eax
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x8c]
push eax
mov dword [ebp - 0x90], ecx
call fcn.004058fe
mov byte [ebp - 4], 1
push dword [ebp - 0x90]
lea eax, [ebp + 0x60]
push eax
call fcn.00428707
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x90], eax
je 0x424e46
push dword [ebp - 0x90]
call fcn.0049f900
pop ecx
push ebx
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.004058b3
lea edi, [ebp + 0x60]
call fcn.00407b6d
push dword [ebp + 0x60]
mov ecx, esi
call fcn.00405394
push ebx
push str.roaming
mov ecx, esi
call fcn.00404cae
push eax
push ebx
lea eax, [ebp + 0x38]
push eax
mov ecx, esi
call fcn.00404cd6
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00405301
push ebx
push 1
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 4
call fcn.004058b3
push str.Local_
mov ecx, esi
call fcn.004052dd
mov ebx, str.GoogleChromeApplicationchrome.exe
push ebx
mov ecx, esi
call fcn.004052dd
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x60]
add ecx, 0xfffffff0
call fcn.00401713
jmp 0x424f15
lea eax, [ebp + 0x38]
push str.USERPROFILE
push eax
call fcn.0040479d
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [ebp - 4], 6
call fcn.00405301
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x38]
call fcn.004058b3
push str.Local_SettingsApplication_Data_
mov ecx, esi
call fcn.004052dd
mov ebx, str.GoogleChromeApplicationchrome.exe
push ebx
mov ecx, esi
call fcn.004052dd
cmp dword [esi + 0x18], 8
jb 0x424f20
mov eax, dword [esi + 4]
jmp 0x424f23
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424fe0
lea eax, [ebp + 0x1c]
push str.ProgramFiles
push eax
call fcn.0040479d
pop ecx
pop ecx
mov dword [ebp - 4], 7
cmp dword [eax + 0x18], 8
jb 0x424f54
mov eax, dword [eax + 4]
jmp 0x424f57
add eax, 4
push 3
push eax
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x110]
push eax
mov dword [ebp - 0x114], ecx
call fcn.004058fe
mov byte [ebp - 4], 8
push dword [ebp - 0x114]
lea eax, [ebp + 0x54]
push eax
call fcn.00428707
lea eax, [ebp - 0x110]
cmp dword [ebp - 0x114], eax
je 0x424f9f
push dword [ebp - 0x114]
call fcn.0049f900
pop ecx
push 0
push 1
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 0xb
call fcn.004058b3
lea edi, [ebp + 0x54]
call fcn.00407b6d
push dword [ebp + 0x54]
mov ecx, esi
call fcn.00405394
push 0x4d5480
mov ecx, esi
call fcn.004052dd
push ebx
mov ecx, esi
call fcn.004052dd
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401713
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x58
leave
ret 4
Function at 0x424ff5
Capabilities:
Check if file exists

Disassembly:
push 0x20
mov eax, 0x4c218b
call fcn.0049f5ab
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00405ece
and dword [ebp - 4], 0
push esi
lea esi, [ebp - 0x2c]
call fcn.00424dbb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x425030
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x425057
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x425047
lea eax, [ebp - 0x28]
push 0xffffffffffffffff
push 1
push 0
push edi
push eax
call fcn.004019da
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004058b3
call fcn.0049f62e
ret 4

Function at 0x4250dc
Capabilities:
Get file version info

Disassembly:
push 0x30
mov eax, 0x4c3136
call fcn.0049f5ab
mov esi, ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 7
call fcn.00405ece
push esi
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00424dbb
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], edi
jae 0x42511a
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jbe 0x42518d
push esi
call fcn.0049e091
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x42518d
push esi
push edi
push ebx
call fcn.0049f650
mov eax, dword [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x14], 8
jae 0x42514e
lea eax, [ebp - 0x28]
push ebx
push esi
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x425186
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x4d5480
push ebx
mov dword [ebp - 0x3c], 0x104
mov dword [ebp - 0x34], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x425186
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 0xa]
mov dword [ebp - 0x30], eax
push ebx
call fcn.0049eec0
pop ecx
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004058b3
mov eax, dword [ebp - 0x30]
call fcn.0049f62e
ret
Function at 0x42991c
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0x20
mov eax, 0x4c218b
call fcn.0049f5ab
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x429942
call fcn.00429a5f
test al, al
jne 0x429942
xor al, al
call fcn.0049f62e
ret
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x42994f
mov eax, dword [edi]
jmp 0x429951
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x429960
mov al, 1
jmp 0x42993c
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00405ece
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.004299dc
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.0042991c
add esp, 0xc
push ebx
test al, al
jne 0x42999c
push 1
lea ecx, [ebp - 0x2c]
call fcn.004058b3
jmp 0x42993a
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x18], 8
jb 0x4299aa
mov edi, dword [edi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4299d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4299d8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004058b3
mov al, bl
jmp 0x42993c
mov bl, 1
jmp 0x4299c5
Function at 0x42b521
Capabilities:
Check if file exists

Disassembly:
push 0x38
mov eax, 0x4c1737
call fcn.0049f542
push str.CFFConfig::Initialize__
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004017f5
or dword [ebp - 4], 0xffffffff
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x28]
call fcn.004058b3
cmp dword [esi + 0x18], ebx
jne 0x42b566
xor al, al
jmp 0x42b702
lea eax, [ebp - 0x28]
push str.APPDATA
push eax
call fcn.0040479d
pop ecx
pop ecx
push 0xffffffffffffffff
push 0
lea ebx, [esi + 0x20]
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00405301
or dword [ebp - 4], 0xffffffff
push 0
push edi
lea ecx, [ebp - 0x28]
call fcn.004058b3
push 0x4d51f0
mov ecx, ebx
call fcn.00404d1c
test eax, eax
je 0x42b55f
push str.MozillaFirefoxProfiles_
mov ecx, ebx
call fcn.004052dd
push 0xffffffffffffffff
push 0
lea edi, [esi + 0x3c]
push ebx
mov ecx, edi
call fcn.00405301
push 0xffffffffffffffff
lea eax, [esi + 4]
push 0
push eax
mov ecx, edi
call fcn.00405c92
mov ebx, 0x4d5480
push ebx
mov ecx, edi
call fcn.004052dd
push str.prefs.js
mov ecx, edi
call fcn.004052dd
push str.CFFConfig::Initialize_____FullProfilePath
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push edi
push eax
mov dword [ebp - 4], 2
call fcn.00401985
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004058b3
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x20]
lea ecx, [esi + 0x58]
push eax
call fcn.00405301
push 0xffffffffffffffff
push 0
lea eax, [esi + 4]
push eax
lea ecx, [esi + 0x58]
call fcn.00405c92
push ebx
lea ecx, [esi + 0x58]
call fcn.004052dd
push str.prefs.js.tmp
lea ecx, [esi + 0x58]
call fcn.004052dd
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x20]
lea ecx, [esi + 0x74]
push eax
call fcn.00405301
push 0xffffffffffffffff
push 0
lea eax, [esi + 4]
push eax
lea ecx, [esi + 0x74]
call fcn.00405c92
push ebx
lea ebx, [esi + 0x74]
mov ecx, ebx
call fcn.004052dd
push str.localstore.rdf
mov ecx, ebx
call fcn.004052dd
cmp dword [edi + 0x18], 8
jb 0x42b692
mov eax, dword [edi + 4]
jmp 0x42b695
lea eax, [edi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b6d1
push str.CFFConfig::ParsePreferences___Initialize_FAILED:
lea ecx, [ebp - 0x28]
call fcn.00404bd0
lea eax, [ebp - 0x28]
push edi
push eax
mov dword [ebp - 4], 3
call fcn.00401985
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004058b3
jmp 0x42b55f
push str.CFFConfig::ParsePreferences___Initialize_OK:
lea ecx, [ebp - 0x44]
call fcn.00404bd0
lea eax, [ebp - 0x44]
push edi
push eax
mov dword [ebp - 4], 4
call fcn.00401985
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.004058b3
mov byte [esi], 1
mov al, 1
call fcn.0049f61a
ret
Function at 0x42b7fb
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c2c9d
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x50e7dc]
xor eax, esp
mov dword [esp + 0x294], eax
push esi
push edi
mov eax, dword [0x50e7dc]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str.CFFConfig::GetNextFFProfile
lea ecx, [esp + 0x18]
call fcn.00404bd0
and dword [esp + 0x2b0], 0
lea eax, [esp + 0x14]
push eax
call fcn.004017f5
or dword [esp + 0x2b4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.004058b3
push 0x4d51f0
mov ecx, edi
call fcn.00405394
lea eax, [esp + 0x30]
push eax
call fcn.0042b708
mov dword [esp + 0x2b4], 1
lea ecx, [esp + 0x34]
mov dword [esp], 0x4da40c
call fcn.004052dd
mov eax, dword [esi]
test eax, eax
jne 0x42b8f1
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x42b8bc
lea eax, [esp + 0x34]
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
je 0x42b901
cmp word [esp + 0x78], 0x2e
je 0x42b8de
test byte [esp + 0x4c], 0x10
jne 0x42b942
lea eax, [esp + 0x4c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42b8cf
jmp 0x42b901
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42b8ca
push dword [esi]
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.004058b3
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.0049f533
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x78]
push eax
mov ecx, edi
call fcn.00405394
mov byte [esp + 0x13], 1
jmp 0x42b90e
Function at 0x42cb92
Capabilities:
Write file on windows

Disassembly:
push 0x40
mov eax, 0x4bf39e
call fcn.0049f542
mov esi, ecx
mov edi, edx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [edi + 0x70], 8
jb 0x42cbb6
mov eax, dword [edi + 0x5c]
jmp 0x42cbb9
lea eax, [edi + 0x5c]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
jne 0x42cc0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CFFConfig::ReWritePrefFile___CreateFile_failed._GetLastError
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00404bd0
lea eax, [ebp - 0x30]
push esi
push eax
mov dword [ebp - 4], ebx
call fcn.004018c5
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004058b3
xor al, al
call fcn.0049f61a
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x10], ebx
jb 0x42cc24
mov eax, dword [esi + 4]
jmp 0x42cc27
lea eax, [esi + 4]
push ebx
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42cc75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.CFFConfig::ReWritePrefFile___WriteFile_failed._GetLastError
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00404bd0
xor esi, esi
lea eax, [ebp - 0x30]
push edi
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.004018c5
pop ecx
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004058b3
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42cc04
mov esi, dword [esi + 0x14]
cmp dword [ebp - 0x10], esi
jae 0x42ccb8
push str.CFFConfig::ReWritePrefFile_____WriteFile_failed._size_written_too_small
lea ecx, [ebp - 0x4c]
call fcn.00404bd0
mov dword [ebp - 4], 2
push dword [ebp - 0x10]
lea eax, [ebp - 0x4c]
push eax
call fcn.004018c5
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.004058b3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x42cc06
mov bl, 1
jmp 0x42ccaa
Function at 0x42de25
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x4be7af
call fcn.0049f5ab
mov ebx, ecx
cmp dword [ebx + 0x3c], 0
mov dword [ebp - 0x38], ebx
je 0x42df3a
cmp byte [ebx + 0x41], 0
je 0x42df3a
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x42de5d
xor al, al
jmp 0x42df3c
push 0
push 8
pop edi
lea esi, [ebp - 0x30]
call fcn.0042da25
and dword [ebp - 4], 0
lea eax, [ebx + 0x44]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.0042da68
mov esi, eax
call fcn.0042df95
mov edi, eax
add edi, dword [ebp - 0x40]
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.0042da68
mov esi, eax
call fcn.0042df95
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
push edi
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x42ded2
dec eax
je 0x42ded6
dec eax
dec eax
je 0x42df36
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00404ec6
mov al, bl
jmp 0x42df3c
mov byte [ebx + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.0042da68
mov esi, eax
call fcn.0042df95
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x42df14
push dword [ebx + 0x4c]
lea eax, [ebp - 0x50]
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.0042da68
mov esi, eax
call fcn.0042df95
push eax
call fcn.004a276c
add esp, 0x10
cmp edi, eax
jne 0x42dec0
cmp byte [ebx + 0x41], 0
je 0x42df36
test edi, edi
jne 0x42de74
push edi
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.0041ce74
mov ebx, dword [ebp - 0x38]
jmp 0x42de74
mov bl, 1
jmp 0x42dec2
mov al, 1
call fcn.0049f62e
ret