joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486400
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x42
push 0x6e0994
push 0x6e09d0
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004fdc20
mov ecx, esi
call fcn.004fa920
xor ebx, ebx
test al, al
je 0x486545
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x486569
mov edi, 2
mov dword [esp + 4], 4
mov ecx, esi
call fcn.004866b0
xor ecx, ecx
push ecx
push ebx
push ecx
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x4864c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x486615
mov eax, edi
inc eax
cmp eax, 2
jb 0x4864bc
mov dword [esi + 0x24], edi
call fcn.005080f0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
inc edi
cmp edi, 2
jb 0x486565
mov dword [esp + 0xc], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [0x6e181c]
xor edx, ecx
mov edi, dword [0x6e1818]
xor edi, eax
or edi, edx
mov edx, dword [ebx + 8]
jne 0x4865a0
cmp edx, dword [0x6e1820]
jne 0x4865a0
mov ecx, esi
call fcn.004867a0
mov edi, eax
add eax, 0xffffffff
adc edx, 0xffffffff
xor ebx, ebx
cmp eax, 0xffffffff
sbb edx, 0
jae 0x486545
xor ecx, ecx
xor eax, eax
mov edx, dword [esp + 4]
push eax
push ebx
push ecx
push edx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x486565
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov bl, 1
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x486545
dec eax
cmp eax, 3
ja case.default.0x486573
jmp dword [eax*4 + 0x6e09e8]
sub esp, 4
mov ecx, esi
call fcn.004862b0
mov ebx, eax
jmp 0x486545
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
mov edi, 4
mov dword [esp + 4], 2
jmp 0x48647b
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea ebx, [esp + 8]
mov dword [ebx], edi
lea edi, [esp + 0xc]
push edi
push ebx
lea edi, [esp + 0x18]
push edi
push edx
push ecx
push eax
call fcn.004912b0
add esp, 0x18
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
lea eax, [esp + 0xc]
mov eax, dword [eax]
mov ecx, eax
sar ecx, 0x1f
add eax, edi
adc ecx, 0
mov edx, ecx
and edx, 1
neg edx
xor ecx, edx
setne bl
mov ecx, dword [esp + 0x14]
test ecx, ecx
js 0x486565
test bl, bl
jne 0x486565
test edx, edx
js 0x486565
test eax, eax
je 0x486565
mov ebx, dword [esp + 0x10]
jmp 0x486524
call fcn.005080f0
push dword [esi + 0x24]
call fcn.004f9550
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x4864ac
xor eax, eax
dec eax
mov dword [esp + 4], eax
xor edi, edi
jmp 0x48647b
mov edi, 8
xor eax, eax
inc eax
mov dword [esp + 4], eax
jmp 0x48647b
Function at 0x4866c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x97
push 0x6e09f8
push 0x6e0a7b
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.004fdc20
test ebx, ebx
js 0x486780
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00516850
test al, al
jne 0x486785
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
push 0
push edi
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.005168e0
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor esi, esi
dec esi
jmp 0x486760
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push 0x6e0a8d
call fcn.0063f920
jmp 0x486735

Function at 0x4867a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xac
push 0x6e09f8
push 0x6e0aa5
push edi
call fcn.005080c0
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.004fdc20
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
call fcn.00516850
test al, al
jne 0x486858
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
mov eax, dword [esp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.005168e0
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x10]
push esi
push esi
push dword [esp + 0xc]
push 0x6e0aaf
call fcn.0063f920
jmp 0x48680a
Function at 0x486870
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov dword [esp + 0xc], ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x78], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x30]
push 0xb9
push 0x6e09f8
push 0x6e0abf
push esi
call fcn.005080c0
add esp, 0x10
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.004fdc20
mov dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call fcn.00516850
test al, al
jne 0x4869c7
xor eax, eax
dec eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x48699e
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 4], xmm0
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x48699e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
test eax, eax
je 0x48699e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi]
sub esp, 0x14
movsd xmm0, qword [esp + 0x24]
movsd qword [esp + 4], xmm0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea ecx, [esp + 0x30]
call fcn.005168e0
lea ecx, [esp + 0x40]
call fcn.004fdc90
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esp + 0x30]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x14]
push 0x6e0ac9
call fcn.0063f920
jmp 0x4868e1
Function at 0x486c30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push 0x6e09f8
push 0x6e0b01
push esi
call fcn.005080c0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004fdc20
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x486e51
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jb 0x486e26
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov ebx, eax
shl ebx, 0xd
and ebx, 0x4000000
or ebx, edi
mov esi, eax
shl esi, 8
and esi, 0xa000000
or esi, ebx
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov edi, eax
jns 0x486d5d
mov edi, dword [eax]
xor ebx, ebx
push ebx
push esi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov ebx, dword [esp + 4]
cmp dword [ebx], eax
je 0x486da5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
inc eax
cmp eax, 2
jae 0x486e37
mov eax, edi
inc eax
cmp eax, 2
jb 0x486d9c
mov dword [ebx], edi
call fcn.005080f0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebx]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jb 0x486df1
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
test cl, 4
jne 0x486e05
test cl, 0xa
je 0x486dcd
mov byte [ebx + 0x18], 1
bt ecx, 0x15
jb 0x486e19
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00486b10
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x486dd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [ebx + 0x18]
jmp 0x486dcd
push dword [ebp + 8]
call fcn.00488ab0
add esp, 4
jmp 0x486dd3
bt ebx, 0x15
jb 0x486e6e
or edx, 0x20000000
jmp 0x486cee
call fcn.005080f0
push dword [ebx]
call fcn.004f9550
add esp, 4
mov dword [ebx], 0
jmp 0x486d8d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.005cf110
jmp 0x486dd3
int3
Function at 0x486f40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x486f75
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x486f7c
lea eax, [ebx + 1]
cmp eax, 2
jb 0x486f6e
mov dword [esi], ebx
call fcn.005080f0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005080f0
push dword [esi]
call fcn.004f9550
add esp, 4
mov dword [esi], 0
jmp 0x486f5f

Function at 0x487070
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00487080
Function at 0x4872e0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.00487080

Function at 0x4872f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x460
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x458], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea eax, [esp + 0x250]
push 0x1db
push 0x6e0b70
push 0x6e0ba7
push eax
call fcn.005080c0
add esp, 0x10
mov ecx, esi
lea esi, [esp + 0x250]
push 0
push esi
call fcn.004fdc20
mov eax, 0x208
mov ecx, 0xff
push eax
push ecx
push esi
call fcn.00553af0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x487378
mov eax, dword [ebx]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.00502140
add esp, 0xc
push esi
call fcn.004e4ad0
add esp, 4
lea esi, [esp + 0x48]
mov eax, 0x208
push eax
mov eax, 0xff
push eax
push esi
call fcn.00553af0
add esp, 0xc
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x4873b4
mov eax, dword [edi]
mov ecx, 0x104
push ecx
push eax
push esi
call fcn.00502140
add esp, 0xc
push esi
call fcn.004e4ad0
add esp, 4
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4873d7
mov eax, dword [ebx]
cmp byte [edi + 0xb], 0
mov ecx, edi
jns 0x4873e1
mov ecx, dword [edi]
sub esp, 0x18
movsd xmm0, qword [0x6e0b50]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x48743f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00486b10
add esp, 4
mov dword [esp + 0xc], eax
cmp byte [edi + 0xb], 0
jns 0x48741d
mov edi, dword [edi]
mov esi, dword [ebp + 0x10]
cmp byte [ebx + 0xb], 0
jns 0x487428
mov ebx, dword [ebx]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test esi, esi
je 0x487441
test eax, eax
jne 0x487441
jmp 0x487462
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.004fdc90
mov ecx, dword [esp + 0x458]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0xc], 0xfffffffc
jne 0x487472
call fcn.005c94e0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi], eax
xor ebx, ebx
jmp 0x487441
Function at 0x487480
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x20e
push 0x6e0b70
push 0x6e0bb4
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004fdc20
cmp byte [edi + 0xb], 0
jns 0x4874dc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.004fdc90
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x487510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x217
push 0x6e0b70
push 0x6e0d0b
push esi
call fcn.005080c0
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.004fdc20
cmp byte [edi + 0xb], 0
jns 0x487571
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x487607
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x4875ca
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x487603
call fcn.005080f0
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x4875e5
call fcn.005080f0
push esi
call fcn.004f9550
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004fdc90
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x4875c3
xor ebx, ebx
jmp 0x4875e5
Function at 0x487610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x236
push 0x6e0b70
push 0x6e0bbf
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004fdc20
cmp byte [edi + 0xb], 0
jns 0x48766c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.004fdc90
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4876a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.00553af0
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x487723
push ebx
call fcn.0056ac44
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00508430
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00491d10
mov ecx, dword [ebp + 8]
push ebx
call fcn.00508590
mov ecx, ebx
call fcn.00508510
mov ecx, edi
call fcn.00508510
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x487750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x754040]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.00553af0
sub esp, 8
mov dword [esp + 0x10], edi
movsd xmm0, qword [0x6e0b60]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4877cd
cmp word [ebp - 0x214], 0
je 0x4877cd
push edi
call fcn.0056ac44
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00508430
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00550b46
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.005083a0
push edi
call fcn.004876a0
add esp, 4
mov ecx, esi
test al, al
jne 0x487802
push 3
push 0x6e0bd0
call fcn.00508430
jmp 0x487808
push edi
call fcn.00508400
lea ecx, [ebp - 0x220]
call fcn.00508510
jmp 0x4877b7
Function at 0x487ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x754040]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x75ab20], 0
jne 0x487dc3
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2bc
push 0x6e0b70
push 0x6e0c1a
push ebx
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.004fdc20
cmp dword [ebp + 8], 0
je 0x487dca
xor eax, eax
dec eax
lea esi, [esp + 4]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
call fcn.005083a0
push esi
push 0x65
call fcn.004898c0
add esp, 8
test al, al
je 0x487d07
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push 0x6e0c2e
push ebx
call fcn.004919d0
mov ecx, esi
push ebx
call fcn.00508590
mov ecx, ebx
call fcn.00508510
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x40]
push 0x20e
push 0x6e0b70
push 0x6e0bb4
push edi
call fcn.005080c0
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.004fdc20
cmp byte [esi + 0xb], 0
jns 0x487ca1
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.004fdc90
cmp esi, 0xffffffff
je 0x487d07
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00487510
add esp, 4
test al, al
je 0x487d07
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.00508530
mov ecx, esi
call fcn.00508510
mov bl, 1
lea ecx, [esp + 0x10]
call fcn.004fdc90
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.00550b46
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 4]
call fcn.00508510
xor eax, eax
dec eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ebx, [esp + 4]
mov ecx, ebx
call fcn.005083a0
push ebx
push 0x67
call fcn.004898c0
add esp, 8
test al, al
je 0x487db3
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x20e
push 0x6e0b70
push 0x6e0bb4
push edi
call fcn.005080c0
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.004fdc20
cmp byte [esp + 0xf], 0
jns 0x487d80
mov ebx, dword [esp + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.004fdc90
cmp ebx, 0xffffffff
je 0x487db3
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.00487510
add esp, 4
test al, al
jne 0x487cd0
lea ecx, [esp + 4]
call fcn.00508510
xor ebx, ebx
jmp 0x487ce6
xor ebx, ebx
jmp 0x487cef
int3