joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412112
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xa8
mov eax, 0x48836b
call fcn.0044465a
mov eax, dword [ebp + 8]
xor edi, edi
push edi
mov dword [ebp - 0x40], eax
push edi
lea eax, [ebp - 0x7c]
call fcn.0042a348
mov esi, eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.00401570
test al, al
je 0x41232d
cmp byte [ebp - 0x74], 7
jne 0x41232d
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.0042a67c
push edi
push edi
lea eax, [ebp - 0x9c]
call fcn.0042a348
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x54]
cmp esi, dword [ebp - 0x50]
jbe 0x41217e
call fcn.004437aa
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x54], eax
jbe 0x412197
call fcn.004437aa
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x3c]
cmp eax, edi
je 0x4121af
cmp eax, dword [ebp - 0x84]
je 0x4121b4
call fcn.004437aa
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x38], eax
je 0x4122ae
lea esi, [ebp - 0x3c]
call fcn.00404dde
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0042a649
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00411d74
pop ecx
pop ecx
mov byte [ebp - 4], 7
cmp byte [ebp - 0xac], 7
jne 0x412292
call fcn.00404dde
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0042a649
mov esi, str.__config
push eax
mov edx, esi
call fcn.0042a627
push eax
lea ebx, [ebp - 0x34]
call fcn.004294d8
mov byte [ebp - 4], 8
cmp byte [ebp - 0x2c], 7
jne 0x41224d
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ebx, esp
mov dword [ebp - 0x44], esp
push eax
call fcn.004294d8
lea eax, [ebp - 0xb4]
push eax
mov edx, esi
mov byte [ebp - 4], 9
call fcn.0042a627
mov edi, eax
mov byte [ebp - 4], 8
call fcn.004296ef
sub esp, 0x18
lea eax, [ebp - 0xb4]
mov ebx, esp
mov dword [ebp - 0x44], esp
push eax
call fcn.004294d8
lea esi, [ebp - 0x3c]
mov byte [ebp - 4], 0xa
call fcn.00404dde
lea ecx, [ebp - 0x9c]
push ecx
call fcn.0042a649
mov edi, eax
mov byte [ebp - 4], 8
call fcn.004296ef
lea esi, [ebp - 0x34]
mov byte [ebp - 4], 7
call fcn.0042966c
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 6
call fcn.0042966c
lea esi, [ebp - 0x3c]
call fcn.0040376f
jmp 0x4121a0
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x94], 7
jne 0x4122f2
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0042aa9b
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
jae 0x4122db
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x40]
call fcn.0041c03b
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.00403c15
push dword [ebp - 0x40]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [ebp - 0x9c]
mov edi, eax
mov byte [ebp - 4], 3
call fcn.0042966c
lea esi, [ebp - 0x60]
call fcn.00403eb6
push dword [ebp - 0x60]
call fcn.004437e4
or dword [ebp - 4], 0xffffffff
pop ecx
lea esi, [ebp - 0x7c]
call fcn.0042966c
mov eax, edi
jmp 0x41233b
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x7c]
call fcn.0042966c
xor eax, eax
call fcn.004446dd
ret
Function at 0x4124d4
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
mov esi, ecx
call fcn.00444cd0
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..json
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push eax
mov edx, esi
call fcn.00412112
pop ecx
test eax, eax
jne 0x41254a
push str._TranslateRuleFile._TranslateJson_failed
call fcn.0041fc97
pop ecx
xor eax, eax
jmp 0x412583
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412562
push str.translate_rule_failed
jmp 0x412540
push 0
push edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044302b
leave
ret

Function at 0x412694
Capabilities:
Delete file

Disassembly:
push 0x244
mov eax, 0x489c47
call fcn.0044465a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00444cd0
add esp, 0xc
lea esi, [ebp - 0x218]
call fcn.0041be3e
push str..json
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, esi
push eax
call fcn.00412341
pop ecx
test eax, eax
jne 0x4127a7
push str.download_rule_failed__try_change_a_path_to_download
call fcn.0041f771
pop ecx
mov edi, str.cache
lea ecx, [ebp - 0x234]
call fcn.004217cf
push 0x48e964
lea eax, [ebp - 0x234]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040352c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040352c
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x41274b
lea eax, [ebp - 0x230]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x218]
push eax
call fcn.00412341
pop ecx
test eax, eax
jne 0x412795
push 0x4909fc
push 0x490a04
call fcn.00412590
pop ecx
pop ecx
push esi
push 1
lea esi, [ebp - 0x234]
call fcn.00403d0d
xor eax, eax
jmp 0x41282e
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0x234]
call fcn.00403d0d
lea eax, [ebp - 0x218]
push eax
push str.download_rule_file_ok:__s
call fcn.0041f771
lea eax, [ebp - 0x250]
push eax
call fcn.004119e5
add esp, 0xc
mov dword [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x4127d9
mov eax, dword [eax + 4]
jmp 0x4127dc
add eax, 4
mov edi, eax
lea ecx, [ebp - 0x218]
call fcn.004124d4
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea esi, [ebp - 0x250]
mov edi, eax
call fcn.00403d0d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x41281b
push 0x490a44
push 0x490a04
jmp 0x412825
push 0x4909fc
push 0x490a4c
call fcn.00412590
pop ecx
pop ecx
mov eax, edi
call fcn.004446dd
ret
Function at 0x412b27
Capabilities:
Delete file
Move file

Disassembly:
push 0x38
mov eax, 0x488db8
call fcn.004445f1
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
call fcn.0042a348
mov ecx, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], 2
call fcn.00401570
test al, al
je 0x412bfd
cmp byte [ebp - 0x20], 7
jne 0x412bfd
lea ecx, [ebp - 0x44]
call fcn.00421025
cmp dword [eax + 0x18], 8
jb 0x412b75
mov eax, dword [eax + 4]
jmp 0x412b78
add eax, 4
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push 1
lea esi, [ebp - 0x44]
mov edi, eax
call fcn.00403d0d
cmp edi, ebx
je 0x412bf1
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x412bad
mov ebx, str.cfgupt
mov edi, str.Softwareprojonepodlp_
call fcn.0041dce5
xor ebx, ebx
lea ecx, [ebp - 0x44]
call fcn.00421025
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x412bc4
mov eax, dword [eax + 4]
jmp 0x412bc7
add eax, 4
push eax
call fcn.0041d6f4
push ebx
push 1
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00403d0d
call fcn.00411a67
cmp dword [ebp + 0x10], ebx
je 0x412c0c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x412c0c
push str.move_global_cfg_failed
call fcn.0041fc97
jmp 0x412c0b
push dword [ebp + 8]
push str.invalid_global_config_file:__s
call fcn.0041fc97
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x28]
call fcn.0042966c
xor eax, eax
call fcn.004446c9
ret 0xc
Function at 0x416972
Capabilities:
Check if file exists

Disassembly:
push 0x2a4
mov eax, 0x48812c
call fcn.0044465a
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push esi
push eax
call fcn.00444cd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov ebx, 0x491958
xor ecx, ecx
call fcn.0041bf89
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416b37
push esi
push esi
lea eax, [ebp - 0x23c]
call fcn.0042a348
mov esi, eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 2
call fcn.00401570
test al, al
je 0x416b15
cmp byte [ebp - 0x234], 6
jne 0x416b15
push 0x48e56b
lea ecx, [ebp - 0x270]
call fcn.0040344e
sub esp, 0x18
mov dword [ebp - 0x220], esp
mov eax, esp
je 0x416a3a
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__.0
mov dword [eax], 0x4922dc
mov dword [eax + 4], fcn.0040121b
mov dword [eax + 0x10], eax
sub esp, 0x18
mov dword [ebp - 0x224], esp
mov eax, esp
je 0x416a5d
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__.0
mov dword [eax], 0x4922c0
mov dword [eax + 4], 0x418351
mov dword [eax + 0x10], eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
call fcn.00401615
lea ecx, [ebp - 0x290]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00405846
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b0]
push ecx
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00423a36
add esp, 0x1c
mov byte [ebp - 4], 0xa
push edi
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.004183ca
add esp, 0x1c
lea eax, [ebp - 0x2b0]
push eax
mov byte [ebp - 4], 0xc
call fcn.00403826
lea eax, [ebp - 0x290]
push eax
mov byte [ebp - 4], 0xb
call fcn.00403826
lea esi, [ebp - 0x254]
call fcn.00403eb6
push dword [ebp - 0x254]
call fcn.004437e4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x270]
call fcn.00403c15
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x23c]
call fcn.0042966c
jmp 0x416b3d
lea eax, [ebp - 0x21c]
push eax
push str.invalid_json_file:__s
call fcn.0041fc97
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea esi, [ebp - 0x23c]
call fcn.0042966c
push edi
call fcn.0040379a
mov eax, edi
call fcn.004446dd
ret
Function at 0x417e07
Capabilities:
Check if file exists
Move file

Disassembly:
push 0x94
mov eax, 0x489339
call fcn.0044465a
and dword [ebp - 0x34], 0
mov edi, str.__pendingUpgradeChecked
push edi
mov esi, 0x490a70
push esi
call fcn.0041e054
pop ecx
pop ecx
test al, al
je 0x417e40
push str.not_first_time_instance__dont_check_pending_upgrade
call fcn.0041f771
jmp 0x41801e
push 4
lea eax, [ebp - 0x4c]
push eax
push 4
push edi
push esi
mov dword [ebp - 0x4c], 1
call fcn.0041dfa8
add esp, 0x14
push str.check_pending_upgrade_now
call fcn.0041f771
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x40], esp
push eax
call fcn.0040379a
lea ecx, [ebp - 0x68]
call fcn.00416b45
add esp, 0x20
and dword [ebp - 4], 0
call fcn.0041c10e
mov edx, dword [ebp - 0x68]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x54]
setne cl
push 8
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edx
pop edi
inc ecx
mov dword [ebp - 0x40], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x417eb3
cmp eax, dword [ebp - 0x48]
je 0x417eb8
call fcn.004437aa
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x38], eax
je 0x41800e
lea esi, [ebp - 0x3c]
call fcn.0043524c
mov ecx, dword [ebp - 0x40]
test dword [eax + 0x240], ecx
je 0x418001
call fcn.0043524c
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040121b
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], edi
jb 0x417efd
mov eax, dword [eax + 4]
jmp 0x417f00
add eax, 4
push eax
call fcn.0041577f
push eax
push 0x49148c
lea ecx, [ebp - 0x30]
call fcn.0041dbb7
add esp, 0xc
push 0
push 1
lea esi, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.00403d0d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x417f35
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417f7f
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x417f4b
lea eax, [ebp - 0x2c]
push eax
lea ebx, [ebp - 0xa0]
call fcn.00431f41
pop ecx
mov ebx, eax
mov byte [ebp - 4], 4
or dword [ebp - 0x34], 1
lea esi, [ebp - 0x3c]
call fcn.0043524c
lea ecx, [eax + 0x224]
mov eax, ebx
call fcn.004058be
test al, al
je 0x417f7f
mov bl, 1
jmp 0x417f81
xor bl, bl
mov dword [ebp - 4], 3
test byte [ebp - 0x34], 1
je 0x417fa1
and dword [ebp - 0x34], 0xfffffffe
push 0
push 1
lea ecx, [ebp - 0xa0]
call fcn.00403c15
test bl, bl
je 0x417ff1
lea esi, [ebp - 0x3c]
call fcn.0043524c
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x417fb8
lea ecx, [ebp - 0x2c]
push 1
add eax, 0x1c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 0x2c]
je 0x417fdc
cmp dword [ebp - 0x18], edi
jae 0x417fd4
lea eax, [ebp - 0x2c]
push eax
push str.pending_upgrade_processed:__s
jmp 0x417fea
cmp dword [ebp - 0x18], edi
jae 0x417fe4
lea eax, [ebp - 0x2c]
push eax
push str.effect_pending_upgrade_failed:__s
call fcn.0041f771
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00403d0d
lea esi, [ebp - 0x3c]
call fcn.00440f2d
jmp 0x417ea7
lea esi, [ebp - 0x68]
call fcn.0041824a
push dword [ebp - 0x68]
call fcn.004437e4
pop ecx
call fcn.004446dd
ret
Function at 0x4197ac
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
cmp byte [0x4b4ddf], bl
je 0x4197f6
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push ebx
push ebx
push ebx
push 0x4191a7
mov ebp, 0x10000
push ebp
push ebx
mov byte [0x4b4ddf], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push ebx
push ebx
push ebx
push 0x41921b
push ebp
push ebx
call esi
push eax
call edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
xor al, al
pop ebx
ret
Function at 0x41a47f
Capabilities:
Delete file
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x4891fd
call fcn.004445f1
xor eax, eax
cmp dword [0x4b47c4], eax
je 0x41a60a
push eax
push eax
lea eax, [ebp - 0x2c]
call fcn.0042a348
sub esp, 0x18
mov ebx, 0x4b47b0
mov dword [ebp - 4], 2
mov edx, ebx
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.0042949c
lea eax, [ebp - 0x2c]
push eax
mov edx, str.user
mov byte [ebp - 4], 3
call fcn.0042a627
mov edi, eax
mov byte [ebp - 4], 2
call fcn.004296ef
lea eax, [ebp - 0x48]
push eax
call fcn.00420d7a
sub esp, 0x14
mov byte [ebp - 4], 4
mov edx, eax
mov esi, esp
mov dword [ebp - 0x14], esp
call fcn.0042949c
lea eax, [ebp - 0x2c]
push eax
mov edx, 0x48fd60
mov byte [ebp - 4], 5
call fcn.0042a627
mov edi, eax
mov byte [ebp - 4], 4
call fcn.004296ef
xor esi, esi
push 0
inc esi
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00403c15
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call fcn.0042aa9b
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 0x10
jb 0x41a541
mov eax, dword [eax + 4]
jmp 0x41a544
add eax, 4
push 0x3e8
push str.userLogoff
mov ecx, eax
call fcn.004118ae
push 0
push esi
lea ecx, [ebp - 0x48]
mov edi, eax
mov byte [ebp - 4], 2
call fcn.00403c15
test edi, edi
je 0x41a570
push edi
call fcn.0041f4d9
lea edi, [ebp - 0x48]
call fcn.0041905b
mov byte [ebp - 4], 7
cmp dword [eax + 0x18], 0x10
jb 0x41a587
mov ecx, dword [eax + 4]
jmp 0x41a58a
lea ecx, [eax + 4]
push str.mqUnsubscribe
call fcn.004188f4
push 0
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00403c15
push 0x48e56b
mov ecx, ebx
call fcn.00403b0c
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.__lu
push 0x48fa18
mov ebx, reloc.WS2_32.dll_bind
push ebx
call edi
lea eax, [ebp - 0x48]
push eax
call fcn.00411a26
cmp dword [eax + 0x18], 8
pop ecx
jb 0x41a5dc
mov eax, dword [eax + 4]
jmp 0x41a5df
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
lea esi, [ebp - 0x48]
call fcn.00403d0d
push str.__urh
push 0x48fa18
push ebx
call edi
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.0042966c
call fcn.004446c9
ret
Function at 0x41b768
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa88], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa8c], edx
test esi, esi
je 0x41b98d
test eax, eax
jne 0x41b7b9
test ecx, ecx
je 0x41b98d
movzx eax, word [esi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ax, 0x3a
je 0x41b80f
cmp ax, 0x5c
je 0x41b80f
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.00444cd0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x828]
push eax
call edi
lea esi, [ebp - 0x828]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41b98d
test al, 0x10
je 0x41b98d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x492bdc
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa90], eax
cmp eax, 0xffffffff
je 0x41b98d
mov dword [ebp - 0xa7c], 1
push 0x492be0
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b952
push 0x48ea88
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41b952
cmp dword [ebp - 0xa78], 0xffffffff
je 0x41b952
push esi
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
test byte [ebp - 0xa78], 0x10
je 0x41b932
cmp dword [ebp - 0xa80], 0
je 0x41b8f6
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa80]
test eax, eax
je 0x41b96f
cmp dword [ebp + 0xc], 0
je 0x41b952
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push dword [ebp - 0xa80]
push dword [ebp - 0xa88]
push dword [ebp - 0xa84]
push dword [ebp + 0xc]
push eax
call fcn.0041b768
push 2
pop ecx
cmp eax, ecx
jne 0x41b952
mov dword [ebp - 0xa7c], ecx
jmp 0x41b979
cmp dword [ebp - 0xa84], 0
je 0x41b952
push dword [ebp - 0xa88]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa84]
test eax, eax
je 0x41b96f
lea eax, [ebp - 0xa78]
push eax
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41b872
jmp 0x41b979
mov dword [ebp - 0xa7c], 2
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa7c]
jmp 0x41b98f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
leave
ret 0x18
Function at 0x41b9e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp edi, ebx
je 0x41badd
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x41badd
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00444cd0
add esp, 0xc
lea esi, [ebp - 0x210]
mov ecx, edi
call fcn.0041c3bd
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ba5a
shr eax, 4
not eax
and eax, 1
jmp 0x41badf
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x418]
call fcn.0041baed
test eax, eax
je 0x41badd
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x41babf
mov dword [ebp - 0x41c], 1
cmp eax, 0xffffffff
jne 0x41bac5
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x420]
call fcn.00407285
xor eax, eax
cmp byte [ebp - 0x41c], bl
setne al
jmp 0x41badf
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
leave
ret
Function at 0x41be3e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x41bea4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00444cd0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41bea4
push esi
push 0
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x41bea4
xor eax, eax
inc eax
jmp 0x41bea6
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044302b
leave
ret

Function at 0x41beb2
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41bec9
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret
test al, 1
je 0x41bed8
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x41bf65
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41bf78
xor eax, eax
jmp 0x41bf86
or eax, 6
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x41c03b
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x41c067
call fcn.0041b9e3
test eax, eax
jne 0x41c067
pop edi
pop esi
pop ebx
leave
ret 0xc
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, ebx
je 0x41c087
cmp esi, 0xffffffff
jne 0x41c09f
cmp dword [ebp - 8], ebx
jne 0x41c093
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc]
call fcn.00407285
mov eax, ebx
jmp 0x41c060
mov edi, dword [ebp + 0x10]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c0c3
cmp dword [ebp - 4], edi
jne 0x41c0c3
xor ebx, ebx
inc ebx
jmp 0x41c093
cmp dword [ebp - 8], ebx
jne 0x41c093
or dword [ebp - 0xc], 0xffffffff
cmp esi, 0xffffffff
je 0x41c0dc
cmp esi, ebx
je 0x41c0dc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
jmp 0x41c08d

Function at 0x41c0e1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x41c109
push esi
mov edx, dword [esp + 8]
movzx edx, byte [ecx + edx]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4b4e00]
inc ecx
cmp ecx, dword [esp + 0xc]
jl 0x41c0ea
pop esi
not eax
ret 8