joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425485
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e3f0
and dword [ebp - 4], 0
cmp dword [0x44f1f0], 0
mov ebx, eax
jne 0x425536
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4255e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4255e7
push eax
call fcn.0041e37e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f1f0], eax
call esi
push eax
call fcn.0041e37e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f1f4], eax
call esi
push eax
call fcn.0041e37e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f1f8], eax
call esi
push eax
call fcn.0041e37e
pop ecx
mov dword [0x44f200], eax
test eax, eax
je 0x425536
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e37e
pop ecx
mov dword [0x44f1fc], eax
mov eax, dword [0x44f1fc]
cmp eax, ebx
je 0x42558e
cmp dword [0x44f200], ebx
je 0x42558e
push eax
call fcn.0041e3f9
push dword [0x44f200]
mov esi, eax
call fcn.0041e3f9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42558e
test edi, edi
je 0x42558e
call esi
test eax, eax
je 0x425585
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425585
test byte [ebp - 0xc], 1
jne 0x42558e
or dword [ebp + 0x10], 0x200000
jmp 0x4255c7
mov eax, dword [0x44f1f4]
cmp eax, ebx
je 0x4255c7
push eax
call fcn.0041e3f9
pop ecx
test eax, eax
je 0x4255c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4255c7
mov eax, dword [0x44f1f8]
cmp eax, ebx
je 0x4255c7
push eax
call fcn.0041e3f9
pop ecx
test eax, eax
je 0x4255c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f1f0]
call fcn.0041e3f9
pop ecx
test eax, eax
je 0x4255e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4255e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c1473
Capabilities:
Get number of processors

Disassembly:
jmp 0x100b5794
call fcn.100b577f
salc
arpl word [ebp - 0x79], cx
loop 0x100b578a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100db3b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100d41dd
jmp 0x100c0476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100cf856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100d7e32
jmp 0x100cf86d
call fcn.100cf858
adc byte [eax - 0x77], dl
loopne 0x100cf87c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x100b577d
jmp 0x100d41f4
call fcn.100d41df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x100b5bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x100b6698
jmp 0x100b7265

Function at 0x100e06f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100cfa70

Function at 0x103e716d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x103e71cb
jmp 0x103e718a
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x103e718a
jmp 0x103e71cb
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x40496f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [0x4183b0]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
mov eax, 0
sete al
jmp 0x4049a8
leave
ret

Function at 0x4049aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [0x4183b0]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
mov eax, 0
sete al
jmp 0x4049e3
leave
ret

Function at 0x405d94
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [str.log.txt]
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret

Function at 0x4142cb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
mov dword [0x41a7b8], eax
mov dword [0x41a7fc], eax
mov dword [0x41a7dc], eax
mov dword [0x41a7d8], eax
mov eax, 0
mov dword [0x41a7bc], eax
mov dword [0x41a7c4], eax
mov eax, 6
push eax
mov eax, dword [0x41a734]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0
mov dword [0x41a7b8], eax
mov dword [0x41a7fc], eax
mov dword [0x41a7dc], eax
mov dword [0x41a7d8], eax
mov eax, 0
mov dword [0x41a7bc], eax
mov dword [0x41a7c4], eax
leave
ret
Function at 0x4145e2
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
nop
mov eax, dword [ebp + 8]
test eax, eax
je 0x414614
mov eax, dword [ebp + 0xc]
cmp eax, 1
jle 0x414614
mov eax, dword [ebp + 0x10]
cmp eax, 1
jle 0x414614
jmp 0x41461e
mov eax, 0
jmp 0x41472a
mov eax, dword [ebp + 8]
push eax
mov eax, 0x20
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.gdi32.dll_CreateBitmap
mov dword [ebp - 4], eax
mov eax, 0
push eax
call sub.user32.dll_GetDC
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 8], eax
mov eax, 0
push eax
call sub.user32.dll_GetDC
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
mov eax, 0xcc0020
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, 0
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4146fd
jmp 0x414707
mov eax, 0
jmp 0x41472a
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
mov eax, 2
push eax
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
mov eax, 1
jmp 0x41472a
leave
ret

Function at 0x414cff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
nop
mov eax, 0x44
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x44]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x10
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x54]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x44
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x8000000
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x414d89
jmp 0x414d93
mov eax, 0
jmp 0x414d9d
mov eax, 1
jmp 0x414d9d
leave
ret
Function at 0x415bda
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
nop
call sub.kernel32.dll_GetTickCount
mov dword [0x4182cc], eax
mov eax, dword [ebp + 8]
mov dword [0x41a730], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x418074], eax
mov eax, 0x419f80
push eax
mov eax, 0x41a080
push eax
call fcn.0040547a
add esp, 8
mov eax, 0x419f80
push eax
mov eax, 0x41a0a0
push eax
call fcn.00405283
add esp, 8
mov eax, 0
push eax
call sub.user32.dll_GetSystemMetrics
mov dword [0x41a4a0], eax
mov dword [0x41a4a8], eax
mov eax, 1
push eax
call sub.user32.dll_GetSystemMetrics
mov dword [0x41a4a4], eax
mov dword [0x41a4ac], eax
mov eax, str.media_cursor_arrow
push eax
mov eax, 0x41abe4
push eax
call fcn.0040f8d1
add esp, 8
test eax, eax
je 0x415c7a
jmp 0x415c9c
mov eax, str.Error_loading_main_cursor__EZ.H_
push eax
call fcn.00405abe
add esp, 4
call fcn.00405d94
call fcn.00414add
mov eax, 0
jmp 0x415e6a
mov eax, str.media_font
push eax
mov eax, 0x41a2a0
push eax
call fcn.00401c08
add esp, 8
mov eax, dword [str.romana_16b]
push eax
mov eax, 0x41aa08
push eax
call fcn.00412d9c
add esp, 8
test eax, eax
je 0x415cd2
jmp 0x415cfb
mov eax, dword [str.romana_16b]
push eax
mov eax, str.Error_loading_main_font__EZ.H_:__s
push eax
call fcn.00405abe
add esp, 8
call fcn.00405d94
call fcn.00414add
mov eax, 0
jmp 0x415e6a
mov eax, str..._.._media_icon_24
push eax
mov eax, 0x41a3a0
push eax
call fcn.00401c08
add esp, 8
mov eax, dword [0x418060]
push eax
mov eax, 0x41a968
push eax
call fcn.0040fbdd
add esp, 8
test eax, eax
je 0x415d31
jmp 0x415d5a
mov eax, dword [0x418060]
push eax
mov eax, 0x419559
push eax
call fcn.00405abe
add esp, 8
call fcn.00405d94
call fcn.00414add
mov eax, 0
jmp 0x415e6a
mov eax, dword [str.code]
push eax
mov eax, 0x41a9b8
push eax
call fcn.0040fbdd
add esp, 8
test eax, eax
je 0x415d7c
jmp 0x415da5
mov eax, dword [str.code]
push eax
mov eax, str.Error_loading_main_icon__EZ.H_:__s
push eax
call fcn.00405abe
add esp, 8
call fcn.00405d94
call fcn.00414add
mov eax, 0
jmp 0x415e6a
mov eax, 0x41aa08
push eax
call fcn.0040fdf3
add esp, 4
mov eax, 0xffffff
push eax
call fcn.0040fece
add esp, 4
call fcn.00415e6e
test eax, eax
je 0x415dd3
jmp 0x415dd8
call fcn.00414add
mov eax, 1
mov dword [0x41946c], eax
mov eax, dword [0x4191a0]
test eax, eax
je 0x415e00
mov eax, dword [0x41808c]
push eax
call fcn.00408be5
add esp, 4
call fcn.00414a71
call sub.kernel32.dll_GetTickCount
mov ecx, dword [0x4182cc]
sub eax, ecx
mov dword [0x4182cc], eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x41a738
push eax
call sub.user32.dll_GetMessageA
test eax, eax
je 0x415e42
jmp 0x415e47
jmp 0x415e5f
mov eax, 0x41a738
push eax
call sub.user32.dll_TranslateMessage
mov eax, 0x41a738
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x415e18
mov eax, dword [0x41a740]
jmp 0x415e6a
leave
ret 0x10
Function at 0x416be0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
nop
lea eax, [ebp - 0x18]
push eax
call fcn.00416e71
add esp, 4
mov eax, 2
push eax
call sub.msvcrt.dll___set_app_type
add esp, 4
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x416ce0
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x416c49
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x416c2b
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x416c96
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
movsx ecx, byte [eax]
test ecx, ecx
je 0x416c91
mov eax, dword [ebp - 0x1c]
mov ecx, 0x22
movsx edx, byte [eax]
cmp ecx, edx
jne 0x416c8f
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x416c91
jmp 0x416c5c
jmp 0x416cc2
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x416cc2
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
je 0x416cc2
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x416c96
mov eax, dword [ebp - 0x1c]
mov ecx, 0x20
movsx edx, byte [eax]
cmp ecx, edx
jne 0x416ce0
mov eax, dword [ebp - 0x1c]
mov ecx, eax
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x416cc2
lea eax, [ebp - 0x60]
push eax
call sub.kernel32.dll_GetStartupInfoA
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
and eax, 1
mov ecx, 0
cmp ecx, eax
jne 0x416d0b
mov eax, 0xa
mov dword [ebp - 0x64], eax
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00415bda
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
call fcn.00414add
add esp, 4
leave
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0xc
movzx eax, word [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x445a44
push eax
push 0
mov dword [esp + 0x18], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40111c
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x2c], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, ebp
mov dword [esp + 0x10], eax
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401070
mov edi, ebp
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401080
mov cx, word [0x445a48]
mov eax, dword [esp + 0x1c]
mov word [edi], cx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401098
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4010a6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x445a18
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.004257ab
mov esi, eax
add esp, 8
test esi, esi
je 0x401104
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push esi
push 1
push edx
push eax
call fcn.00425b33
push esi
call fcn.00425955
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x401130
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x452284]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov ebx, ecx
mov esi, edx
mov byte [esp + 0x14], 0
call fcn.0042b460
push 0x67
lea ecx, [esp + 0x18]
push ecx
push 0x445a2c
call fcn.00401000
push 0x103
lea edx, [esp + 0x129]
push 0
push edx
mov byte [esp + 0x130], 0
call fcn.0042b460
push 0x68
lea eax, [esp + 0x134]
push eax
push 0x445a20
call fcn.00401000
add esp, 0x30
mov edx, esi
mov ecx, ebx
call fcn.00402250
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
push ecx
call esi
lea edx, [esp + 0x10c]
push edx
call esi
mov ecx, dword [esp + 0x210]
pop esi
pop ebx
xor ecx, esp
call fcn.00425608
add esp, 0x20c
ret
Function at 0x4018a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4018e4
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445a6c
call fcn.004019d0
add esp, 0xc
xor eax, eax
pop esi
pop ecx
ret
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x401917
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445a88
call fcn.004019d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401954
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x445aa4
call fcn.004019d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
Function at 0x401dc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x804
mov eax, dword [0x452284]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov esi, ecx
mov al, 0x3a
xor edi, edi
cmp byte [esi + 1], al
jne 0x401e00
cmp byte [esi + 2], 0x5c
jne 0x401e00
mov cl, byte [esi]
mov byte [esp + 8], cl
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
add esi, 3
jmp 0x401e1a
call fcn.00401cc0
lea edx, [esp + 8]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x401e10
cmp byte [esi], 0
je 0x401f7a
push ebx
push ebp
push 0x5c
push esi
call fcn.00426bc0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x401e4b
push 0x2f
push esi
call fcn.00426bc0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x401f01
mov bl, byte [ebp]
mov byte [ebp], 0
cmp byte [esi], 0
je 0x401ec7
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e60
sub eax, edx
cmp byte [esp + eax + 0xf], 0x5c
je 0x401e87
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401e75
mov dx, word [0x445a48]
mov word [edi], dx
mov eax, esi
mov edx, esi
jmp 0x401e90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e90
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401ea0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
mov byte [ebp], bl
lea esi, [ebp + 1]
lea ecx, [ecx]
mov al, byte [esi]
cmp al, 0x5c
je 0x401eda
cmp al, 0x2f
jne 0x401edd
inc esi
jmp 0x401ed0
cmp byte [esi], 0
jne 0x401e25
mov eax, edi
pop ebp
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00425608
add esp, 0x804
ret
cmp byte [esi], 0
je 0x401ee6
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f10
sub eax, edx
cmp byte [esp + eax + 0xf], 0x5c
je 0x401f37
lea edi, [esp + 0x10]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401f25
mov cx, word [0x445a48]
mov word [edi], cx
mov eax, esi
mov edx, esi
jmp 0x401f40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f40
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401f50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea edx, [esp + 0x14]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x401ee8
mov ecx, dword [esp + 0x808]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00425608
add esp, 0x804
ret
Function at 0x401fa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x318
mov eax, dword [0x452284]
xor eax, esp
mov dword [esp + 0x314], eax
push ebx
push ebp
mov ebp, dword [esp + 0x324]
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [esp + 0x21]
push ebx
push eax
mov byte [esp + 0x28], bl
call fcn.0042b460
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0x14]
push edx
call fcn.004262f1
push 0x103
lea eax, [esp + 0x229]
push ebx
push eax
mov byte [esp + 0x230], bl
call fcn.0042b460
add esp, 0x10
push ebx
push 0x1a
lea ecx, [esp + 0x228]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x402082
push 0x103
lea edx, [esp + 0x121]
push ebx
push edx
mov byte [esp + 0x128], bl
call fcn.0042b460
add esp, 0xc
lea eax, [esp + 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40206c
call fcn.00401cc0
lea edx, [esp + 0x1c]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x402060
jmp 0x402094
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x11c]
mov byte [esp + eax + 0x1c], cl
inc eax
cmp cl, bl
jne 0x402070
jmp 0x402094
xor eax, eax
mov cl, byte [esp + eax + 0x220]
mov byte [esp + eax + 0x1c], cl
inc eax
cmp cl, bl
jne 0x402084
cmp byte [esp + 0x1c], bl
je 0x4020bf
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4020a1
sub eax, edx
cmp eax, 2
jb 0x4020bf
cmp byte [esp + eax + 0x1b], 0x5c
je 0x4020bf
mov byte [esp + eax + 0x1c], 0x5c
mov byte [esp + eax + 0x1d], bl
push 0x100
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
xor eax, eax
mov byte [esp + 0x10], bl
mov word [esp + 0x11], ax
mov byte [esp + 0x13], al
xor esi, esi
call fcn.00426303
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add dl, 0x61
mov byte [esp + esi + 0xf], dl
cmp esi, 3
jb 0x4020e3
lea eax, [esp + 0x1c]
mov byte [esp + esi + 0x10], bl
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x402107
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x402115
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x402131
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x402140
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00401dc0
mov ecx, dword [esp + 0x324]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00425608
add esp, 0x318
ret