joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d3f0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x120
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x138]
lea ecx, [edi + edi*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv dword [esi + 4]
mov ebx, dword [esp + 0x13c]
mov ebp, dword [esp + 0x134]
push 0x3f1
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebp
lea eax, [eax + ecx + 3]
push eax
mov ecx, ebx
call fcn.00407a90
xor ecx, ecx
cmp edi, ecx
je 0x40d63a
cmp ebp, ecx
je 0x40d63a
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
test eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
jle 0x40d57d
mov dword [esp + 0x18], eax
jmp 0x40d494
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
movzx edi, byte [esi + ebp + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x511448]
mov byte [esp + ecx + 0x24], dl
add esi, 1
movzx ebp, byte [esi + ebp + 1]
mov edx, edi
sar edx, 4
and edx, 0xf
and eax, 3
shl eax, 4
or edx, eax
movzx eax, byte [edx + 0x511448]
add esi, 1
and edi, 0xf
mov edx, ebp
sar edx, 6
mov byte [esp + ecx + 0x25], al
add ecx, 1
and edx, 3
add edi, edi
add edi, edi
or edx, edi
movzx eax, byte [edx + 0x511448]
add ecx, 1
mov byte [esp + ecx + 0x24], al
mov eax, dword [esp + 0x10]
and ebp, 0x3f
movzx edx, byte [ebp + 0x511448]
add ecx, 1
mov byte [esp + ecx + 0x24], dl
mov edx, dword [esp + 0x20]
add eax, 4
add esi, 1
add ecx, 1
cmp eax, dword [edx + 4]
mov dword [esp + 0x10], eax
jl 0x40d53b
mov byte [esp + ecx + 0x24], 0xd
add ecx, 1
mov byte [esp + ecx + 0x24], 0xa
add ecx, 1
mov dword [esp + 0x10], 0
cmp ecx, 0x100
jl 0x40d552
push ecx
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
call fcn.00407e00
xor ecx, ecx
sub dword [esp + 0x18], 1
jne 0x40d490
test ecx, ecx
je 0x40d56e
push ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebx
call fcn.00407e00
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x138]
mov eax, dword [esp + 0x1c]
lea edx, [eax + eax*2]
sub edi, edx
sub edi, 0
je 0x40d628
sub edi, 1
je 0x40d5e6
sub edi, 1
jne 0x40d63a
movzx edi, byte [esi + ebp]
movzx esi, byte [esi + ebp + 1]
mov eax, edi
sar eax, 2
and eax, 0x3f
movzx ecx, byte [eax + 0x511448]
push ecx
mov ecx, ebx
call fcn.00407630
mov edx, esi
sar edx, 4
and edi, 3
and edx, 0xf
shl edi, 4
or edx, edi
movzx eax, byte [edx + 0x511448]
push eax
mov ecx, ebx
call fcn.00407630
and esi, 0xf
movzx ecx, byte [esi*4 + 0x511448]
push ecx
jmp 0x40d618
movzx esi, byte [esi + ebp]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx eax, byte [edx + 0x511448]
push eax
mov ecx, ebx
call fcn.00407630
and esi, 3
shl esi, 4
movzx ecx, byte [esi + 0x511448]
push ecx
mov ecx, ebx
call fcn.00407630
push 0x3d
mov ecx, ebx
call fcn.00407630
push 0x3d
mov ecx, ebx
call fcn.00407630
push 0xd
mov ecx, ebx
call fcn.00407630
push 0xa
mov ecx, ebx
call fcn.00407630
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ec47e
add esp, 0x120
ret 0xc
Function at 0x40dd30
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x118
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [esp + 0x128]
test ebp, ebp
push edi
mov edi, dword [esp + 0x130]
mov dword [esp + 0xc], edi
je 0x40df24
test ebx, ebx
je 0x40df24
lea ecx, [ebp + ebp*4 + 0xa]
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx]
cdq
idiv ebp
push esi
push 0x3f0
lea eax, [eax + ecx + 3]
push eax
mov ecx, edi
call fcn.00407a90
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
xor ecx, ecx
test eax, eax
mov dword [esp + 0x18], eax
jle 0x40de81
mov dword [esp + 0x14], eax
lea esp, [esp]
movzx eax, byte [ebx + esi]
movzx edi, byte [ebx + esi + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x511448]
mov byte [esp + ecx + 0x1c], dl
add esi, 1
movzx ebp, byte [ebx + esi + 1]
mov edx, edi
sar edx, 4
and edx, 0xf
and eax, 3
add esi, 1
shl eax, 4
or edx, eax
movzx eax, byte [edx + 0x511448]
and edi, 0xf
mov edx, ebp
sar edx, 6
add ecx, 1
add edi, edi
mov byte [esp + ecx + 0x1c], al
and edx, 3
add edi, edi
or edx, edi
movzx eax, byte [edx + 0x511448]
add ecx, 1
and ebp, 0x3f
movzx edx, byte [ebp + 0x511448]
mov byte [esp + ecx + 0x1c], al
add ecx, 1
mov byte [esp + ecx + 0x1c], dl
add ecx, 1
add esi, 1
cmp ecx, 0x100
jl 0x40de54
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
call fcn.00407e00
xor ecx, ecx
sub dword [esp + 0x14], 1
jne 0x40ddc0
test ecx, ecx
je 0x40de72
push ecx
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00407e00
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x130]
mov edi, dword [esp + 0x10]
lea edx, [eax + eax*2]
sub ebp, edx
sub ebp, 1
je 0x40dee1
sub ebp, 1
jne 0x40df23
movzx ebp, byte [ebx + esi]
movzx esi, byte [ebx + esi + 1]
mov eax, ebp
sar eax, 2
and eax, 0x3f
movzx ecx, byte [eax + 0x511448]
push ecx
mov ecx, edi
call fcn.00407630
mov edx, esi
sar edx, 4
and ebp, 3
and edx, 0xf
shl ebp, 4
or edx, ebp
movzx eax, byte [edx + 0x511448]
push eax
mov ecx, edi
call fcn.00407630
and esi, 0xf
movzx ecx, byte [esi*4 + 0x511448]
push ecx
jmp 0x40df13
movzx esi, byte [ebx + esi]
mov edx, esi
sar edx, 2
and edx, 0x3f
movzx eax, byte [edx + 0x511448]
push eax
mov ecx, edi
call fcn.00407630
and esi, 3
shl esi, 4
movzx ecx, byte [esi + 0x511448]
push ecx
mov ecx, edi
call fcn.00407630
push 0x3d
mov ecx, edi
call fcn.00407630
push 0x3d
mov ecx, edi
call fcn.00407630
pop esi
mov ecx, dword [esp + 0x120]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ec47e
add esp, 0x118
ret
Function at 0x40df40
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x40df55
xor eax, eax
pop edi
add esp, 8
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
mov dword [edi], 0
je 0x40e108
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x40e108
lea edx, [ebp + ebp*4 + 0xa]
mov eax, 0x55555556
imul edx
push esi
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + esi]
cdq
idiv dword [ecx + 4]
lea esi, [eax + esi + 3]
push esi
mov dword [edi], esi
call fcn.004eceb1
mov esi, eax
add esp, 4
test esi, esi
jne 0x40dfae
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
xor ecx, ecx
test eax, eax
mov dword [esp + 0x14], eax
jle 0x40e05d
mov dword [esp + 0x10], eax
movzx eax, byte [edi + ebx]
movzx ebp, byte [edi + ebx + 1]
add edi, 1
movzx edx, byte [edi + ebx + 1]
mov ebx, eax
add edi, 1
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x511448]
mov byte [ecx + esi], bl
and eax, 3
mov ebx, ebp
shl eax, 4
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x511448]
mov ebx, dword [esp + 0x1c]
mov byte [ecx + esi + 1], al
add ecx, 1
mov eax, edx
and ebp, 0xf
sar eax, 6
add ebp, ebp
and eax, 3
add ebp, ebp
or eax, ebp
movzx eax, byte [eax + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
and edx, 0x3f
mov dl, byte [edx + 0x511448]
add ecx, 1
mov byte [ecx + esi], dl
add edi, 1
add ecx, 1
sub dword [esp + 0x10], 1
jne 0x40dfd0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*2]
sub ebp, eax
sub ebp, 1
je 0x40e0ba
sub ebp, 1
jne 0x40e0f2
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x511448]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
and edi, 0xf
movzx edx, byte [edi*4 + 0x511448]
mov byte [ecx + esi], dl
jmp 0x40e0e8
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x511448]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov edx, dword [esp + 0x24]
mov byte [ecx + esi], 0
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword [edx], ecx
pop edi
add esp, 8
ret 0xc
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 8
ret 0xc
Function at 0x40eb70
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x40eb85
xor eax, eax
pop esi
add esp, 8
ret 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
mov dword [esi], 0
je 0x40ed29
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x40ed29
lea ecx, [ebp + ebp*4]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
lea eax, [edx + eax + 4]
push eax
mov dword [esi], eax
call fcn.004eceb1
mov esi, eax
add esp, 4
test esi, esi
je 0x40ed29
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
xor edi, edi
xor ecx, ecx
test eax, eax
mov dword [esp + 0x14], eax
jle 0x40ec7e
mov dword [esp + 0x10], eax
movzx eax, byte [edi + ebx]
movzx ebp, byte [edi + ebx + 1]
add edi, 1
movzx edx, byte [edi + ebx + 1]
mov ebx, eax
add edi, 1
sar ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x511448]
mov byte [ecx + esi], bl
and eax, 3
mov ebx, ebp
shl eax, 4
sar ebx, 4
and ebx, 0xf
or ebx, eax
movzx eax, byte [ebx + 0x511448]
mov ebx, dword [esp + 0x1c]
mov byte [ecx + esi + 1], al
add ecx, 1
mov eax, edx
and ebp, 0xf
sar eax, 6
add ebp, ebp
and eax, 3
add ebp, ebp
or eax, ebp
movzx eax, byte [eax + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
and edx, 0x3f
mov dl, byte [edx + 0x511448]
add ecx, 1
mov byte [ecx + esi], dl
add edi, 1
add ecx, 1
sub dword [esp + 0x10], 1
jne 0x40ebf1
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*2]
sub ebp, eax
sub ebp, 1
je 0x40ecdb
sub ebp, 1
jne 0x40ed13
movzx eax, byte [edi + ebx]
movzx edi, byte [edi + ebx + 1]
mov edx, eax
sar edx, 2
and edx, 0x3f
movzx edx, byte [edx + 0x511448]
mov byte [ecx + esi], dl
mov edx, edi
sar edx, 4
and eax, 3
and edx, 0xf
shl eax, 4
or edx, eax
mov al, byte [edx + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
and edi, 0xf
movzx edx, byte [edi*4 + 0x511448]
mov byte [ecx + esi], dl
jmp 0x40ed09
movzx eax, byte [edi + ebx]
mov edx, eax
sar edx, 2
and edx, 0x3f
mov dl, byte [edx + 0x511448]
and eax, 3
mov byte [ecx + esi], dl
shl eax, 4
mov al, byte [eax + 0x511448]
add ecx, 1
mov byte [ecx + esi], al
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov byte [ecx + esi], 0x3d
add ecx, 1
mov edx, dword [esp + 0x24]
pop edi
pop ebp
mov byte [ecx + esi], 0
pop ebx
mov eax, esi
mov dword [edx], ecx
pop esi
add esp, 8
ret 0xc
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 8
ret 0xc
Function at 0x410b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5060bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov ecx, edi
mov dword [esi], 0x511584
call fcn.00408020
xor eax, eax
mov ecx, edi
mov dword [esp + 0x18], eax
mov dword [esi + 0x30], eax
call fcn.00407ec0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4133e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x502320
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebp
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, ecx
mov esi, dword [esp + 0x80]
cmp byte [esi], 0x78
mov byte [esp + 0x13], 1
jne 0x41341e
mov byte [esp + 0x13], 0
lea ecx, [esp + 0x14]
add esi, 1
call fcn.0040d3c0
lea ecx, [esp + 0x30]
mov dword [esp + 0x78], 0
call fcn.00404230
mov eax, esi
mov byte [esp + 0x78], 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x413445
lea ecx, [esp + 0x80]
push ecx
sub eax, edx
push eax
push esi
call fcn.0040e250
add esp, 0xc
test eax, eax
je 0x413559
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x413559
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00404d30
lea ecx, [esp + 0x50]
call fcn.00404230
cmp byte [esp + 0x13], 0
mov byte [esp + 0x78], 2
je 0x4134cd
lea ecx, [esp + 0x20]
call fcn.00452d00
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x80], 3
call fcn.00452c00
lea ecx, [esp + 0x20]
mov byte [esp + 0x78], 2
call fcn.00452d20
jmp 0x4134ea
lea ecx, [esp + 0x30]
call fcn.0046fb70
push eax
lea ecx, [esp + 0x34]
call fcn.004e81e0
push eax
lea ecx, [esp + 0x58]
call fcn.004050c0
lea ecx, [esp + 0x50]
call fcn.004e81e0
mov esi, eax
test esi, esi
je 0x41354b
cmp byte [esi], 0x61
mov edi, dword [esp + 0x84]
mov ecx, edi
jne 0x41350b
push 1
jmp 0x41350d
push 0
call fcn.004524b0
add esi, 1
xor al, al
cmp byte [esi], 0x64
jne 0x41351e
mov al, 1
add esi, 1
test al, al
je 0x41353a
cmp byte [esp + 0x88], 0
je 0x41354b
push edi
push esi
mov ecx, ebp
call fcn.00413340
jmp 0x41354b
mov ecx, dword [esp + 0x88]
push ecx
push edi
push esi
mov ecx, ebp
call fcn.00413150
lea ecx, [esp + 0x50]
mov byte [esp + 0x78], 1
call fcn.00404a00
lea ecx, [esp + 0x30]
mov byte [esp + 0x78], 0
call fcn.00404a00
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xffffffff
call fcn.0040d3e0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x6c
ret 0xc
Function at 0x41e180
Capabilities:
Get session user name

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x1bc], eax
push esi
mov esi, dword [esp + 0x1c8]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x41e1bc
mov byte [esp + 8], al
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00407b70
mov ecx, dword [esp + 0x1c0]
pop esi
xor ecx, esp
call fcn.004ec47e
add esp, 0x1c0
ret

Function at 0x41e200
Capabilities:
Get hostname

Disassembly:
sub esp, 0x80
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x7c], eax
push esi
mov esi, dword [esp + 0x88]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0xc], 0x76
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x41e239
mov byte [esp + 8], al
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00407b70
mov ecx, dword [esp + 0x80]
pop esi
xor ecx, esp
call fcn.004ec47e
add esp, 0x80
ret

Function at 0x41e9b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
fld qword [ecx]
sub esp, 0x24
lea eax, [esp]
push eax
sub esp, 8
fstp qword [esp]
call fcn.0041e790
add esp, 0xc
test al, al
je 0x41ea1c
mov eax, dword [esp + 0x2c]
movzx edx, word [esp + 0x14]
movzx ecx, word [esp + 0x10]
mov word [eax], dx
mov edx, dword [esp + 0x18]
add edx, 0xffffffff
mov word [eax + 2], cx
movzx ecx, word [esp + 0xc]
mov word [eax + 4], dx
movzx edx, word [esp + 8]
mov word [eax + 6], cx
movzx ecx, word [esp + 4]
mov word [eax + 8], dx
movzx edx, word [esp]
mov word [eax + 0xa], cx
mov word [eax + 0xc], dx
mov word [eax + 0xe], 0
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
add esp, 0x24
jmp fcn.0040b280

Function at 0x420490
Capabilities:
Check for time delay via gettickcount

Disassembly:
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.004ed7c5
add esp, 4
jmp fcn.00420340

Function at 0x4204b0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x58b710], 0
jne 0x4204d6
mov dword [0x58b710], 1
call sub.KERNEL32.dll_GetTickCount
push eax
call fcn.004ed7c5
add esp, 4
call fcn.00420340
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
je 0x420581
push ebx
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.0046fb70
add eax, ebp
push eax
mov ecx, edi
call fcn.00405fb0
xor ebx, ebx
call fcn.00420300
test ebp, ebp
jle 0x42056a
push esi
lea esi, [ebp - 1]
shr esi, 2
add esi, 1
lea ebx, [esi*4]
jmp 0x420520
mov eax, dword [0x58b320]
movzx ecx, byte [eax + 0x576778]
mov dword [0x58b320], ecx
mov ecx, dword [0x576770]
movzx edx, byte [ecx + 0x576778]
mov ecx, dword [ecx*4 + 0x58b328]
xor dword [eax*4 + 0x58b328], ecx
lea eax, [eax*4 + 0x58b328]
push 4
push eax
mov ecx, edi
mov dword [0x576770], edx
call fcn.004050c0
sub esi, 1
jne 0x420520
pop esi
cmp ebx, ebp
mov byte [0x58b324], 0
jle 0x42057f
sub ebx, ebp
push ebx
mov ecx, edi
call fcn.004041c0
pop edi
pop ebx
pop ebp
ret
Function at 0x4209e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5033bb
mov eax, dword fs:[0]
push eax
mov eax, 0x18a4
call fcn.004eda00
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x18a0], eax
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x18ac]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18bc]
lea ecx, [esp + 8]
call fcn.004542c0
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0
call fcn.004542f0
test al, al
jne 0x420a5b
lea edx, [esp + 0x8a4]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x420a7f
lea eax, [esp + 0xa0]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.00402920
jmp 0x420a8e
lea edx, [esp + 0x8a4]
push edx
mov ecx, esi
call fcn.00403c10
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0xffffffff
call fcn.004542e0
mov ecx, dword [esp + 0x18ac]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18a0]
xor ecx, esp
call fcn.004ec47e
add esp, 0x18b0
ret

Function at 0x420ad0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5033fb
mov eax, dword fs:[0]
push eax
mov eax, 0x20a8
call fcn.004eda00
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x20a4], eax
push esi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x20b0]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20c0]
lea ecx, [esp + 8]
call fcn.004542c0
lea ecx, [esp + 8]
mov dword [esp + 0x20b8], 0
call fcn.004542f0
test al, al
je 0x420b58
lea eax, [esp + 0x8a4]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x8a4]
push ecx
mov ecx, esi
call fcn.00402920
jmp 0x420bad
lea edx, [esp + 0x10a8]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x420b9e
lea eax, [esp + 0xa0]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x420b8d
mov byte [esp + 0xa0], al
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.00402920
jmp 0x420bad
lea edx, [esp + 0x10a8]
push edx
mov ecx, esi
call fcn.00403c10
lea ecx, [esp + 8]
mov dword [esp + 0x20b8], 0xffffffff
call fcn.004542e0
mov ecx, dword [esp + 0x20b0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20a4]
xor ecx, esp
call fcn.004ec47e
add esp, 0x20b4
ret
Function at 0x420ce0
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x50345c
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov edi, dword [esp + 0x258]
mov esi, dword [esp + 0x25c]
lea ecx, [esp + 0x14]
call fcn.00402710
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x254], 0
call fcn.00403f30
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.00403880
lea ecx, [esp + 0x1ac]
call fcn.004542c0
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x250], 1
call fcn.004542f0
test al, al
lea ecx, [esp + 0x14]
je 0x420d8f
call fcn.00402fe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x420eac
call fcn.00403a70
cmp eax, 0x104
jle 0x420e5e
lea ecx, [esp + 0x124]
call fcn.00402710
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x258], 2
call fcn.004208b0
add esp, 8
lea ecx, [esp + 0x9c]
call fcn.00402710
push str.__
lea ecx, [esp + 0xa0]
mov byte [esp + 0x254], 3
call fcn.00403de0
lea ecx, [esp + 0x124]
call fcn.00403320
push eax
lea ecx, [esp + 0xa0]
call fcn.00403de0
lea ecx, [esp + 0x9c]
call fcn.00403c20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x420e31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x420e2f
mov esi, 1
test esi, esi
lea ecx, [esp + 0x9c]
setne bl
mov byte [esp + 0x250], 2
call fcn.004027d0
lea ecx, [esp + 0x124]
mov byte [esp + 0x250], 1
call fcn.004027d0
jmp 0x420eaf
lea ecx, [esp + 0x14]
call fcn.00403c20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
jne 0x420eac
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov edi, eax
je 0x420ea0
push edi
mov ecx, esi
call fcn.004247b0
mov ebx, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00403320
mov edx, dword [ebx + 0x28]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x420eaa
mov ebp, 1
test ebp, ebp
setne bl
lea ecx, [esp + 0x1ac]
mov byte [esp + 0x250], 0
call fcn.004542e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x250], 0xffffffff
call fcn.004027d0
mov al, bl
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004ec47e
add esp, 0x240
ret
Function at 0x421330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x503531
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5894dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c0]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1d0]
mov ebx, dword [esp + 0x1d8]
mov esi, dword [esp + 0x1d4]
mov ebp, dword [esp + 0x1dc]
mov dword [ebx], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00403a70
test eax, eax
jne 0x4213b8
test ebp, ebp
je 0x4213b1
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push str.GetAttributes:_filename_is_empty
mov ecx, ebp
call edx
xor al, al
jmp 0x4214e5
lea ecx, [esp + 0x14]
call fcn.00402710
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x1cc], 0
call fcn.00403f30
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.00403880
lea ecx, [esp + 0x14]
call fcn.00403a70
lea ecx, [esp + 0x124]
mov edi, eax
call fcn.004542c0
cmp edi, 0x104
mov byte [esp + 0x1c8], 1
jge 0x42143e
lea ecx, [esp + 0x14]
call fcn.00402da0
test al, al
jne 0x421427
lea ecx, [esp + 0x124]
call fcn.004542f0
test al, al
je 0x42143e
lea ecx, [esp + 0x14]
call fcn.00402fe0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x4214ab
test edi, edi
jle 0x421496
lea ecx, [esp + 0x9c]
call fcn.00402710
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1d0], 2
call fcn.00420bf0
add esp, 8
lea ecx, [esp + 0x9c]
call fcn.00402c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x9c]
mov dword [esi], eax
mov byte [esp + 0x1c8], 1
call fcn.004027d0
jmp 0x4214a8
lea ecx, [esp + 0x14]
call fcn.00402c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4214b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x124]
setne bl
mov byte [esp + 0x1c8], 0
call fcn.004542e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c8], 0xffffffff
call fcn.004027d0
mov al, bl
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.004ec47e
add esp, 0x1b8
ret