joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x10c
mov eax, dword [0x41a178]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push esi
mov esi, dword [esp + 0x11c]
mov bl, 0x61
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [esp + 0x14], eax
mov byte [esp + 0x10], bl
mov ecx, dword [esp + 0x10]
push 5
push ecx
call fcn.00401550
add esp, 8
cmp eax, 1
jne 0x40152b
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push 0x104
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x34], bl
call edi
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
je 0x401543
inc bl
cmp bl, 0x7a
mov byte [esp + 0x10], bl
jle 0x4014ec
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x401550
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [0x41a178]
mov cl, byte [esp + 8]
lea edx, [esp]
mov dword [esp], eax
push edx
mov byte [esp + 4], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, dword [esp + 0xc]
xor ecx, ecx
cmp eax, edx
sete cl
mov eax, ecx
pop ecx
ret

Function at 0x401580
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
mov eax, dword [0x41a178]
mov cl, byte [esp + 0x14]
mov dword [esp], eax
lea edx, [esp + 0xc]
mov byte [esp], cl
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x4015bb
add esp, 0x10
ret
mov ecx, dword [esp + 4]
imul ecx, dword [esp + 8]
cmp ecx, 0x400
jae 0x4015da
mov eax, dword [esp + 0x14]
imul eax, ecx
shr eax, 0xa
add esp, 0x10
ret
shr ecx, 0xa
imul ecx, dword [esp + 0x14]
mov eax, ecx
add esp, 0x10
ret
Function at 0x4016b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x418278
push 1
push 0
push 0x418268
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x4017a0
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x218]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x224]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x228]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 4]
push edx
mov edx, dword [esp + 0x230]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x418288
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jne 0x401796
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
add esp, 0x210
ret

Function at 0x401940
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
push edi
mov edi, dword [esp + 0x118]
push edi
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 1
call fcn.00401820
add esp, 4
test eax, eax
jne 0x40197b
pop edi
add esp, 0x110
ret
mov dl, byte [edi]
xor eax, eax
cmp dl, 0x22
push ebp
sete al
mov ebp, eax
mov al, byte [ebp + edi + 3]
push esi
lea esi, [ebp + 3]
test al, al
je 0x4019d5
cmp al, 0x22
je 0x4019d5
lea ecx, [esp + 0x18]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [esp + esi + 0x19]
inc esi
cmp al, 0x5c
je 0x4019b7
test al, al
je 0x4019cc
cmp al, 0x22
jne 0x4019a4
jmp 0x4019cc
lea edx, [esp + 0xc]
lea eax, [esp + ebp + 0x18]
push edx
push eax
mov byte [esp + esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [esi + edi + 1]
inc esi
test al, al
jne 0x401994
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x110
ret
Function at 0x4019f0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x108
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push esi
push edi
push ebp
call fcn.00401820
add esp, 4
test eax, eax
jne 0x401a19
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov bl, byte [ebp]
xor eax, eax
cmp bl, 0x22
push ebp
sete al
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea ebx, [edi + 2]
sub esi, edi
dec esi
cmp esi, ebx
jle 0x401a7c
lea ecx, [esp + edi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x14]
push ebp
push edx
call edi
lea ecx, [esi + 1]
mov al, byte [esp + esi + 0x13]
dec esi
cmp al, 0x5c
je 0x401a63
test al, al
je 0x401a63
cmp al, 0x22
jne 0x401a52
mov eax, dword [esp + 0x10]
mov byte [esp + ecx + 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x401a7c
dec esi
cmp esi, ebx
jg 0x401a47
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret

Function at 0x401b80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0xc0], 1
jne 0x401ba7
mov eax, dword [esi + 0xd0]
mov dword [esi + 0xc0], 0
push eax
call fcn.00410bcc
add esp, 4
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x401bd3
pop esi
xor eax, eax
pop ebp
pop ecx
ret 4
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea edx, [edi + 1]
push edx
call fcn.00410bd7
add esp, 4
mov dword [esi + 0xd0], eax
mov byte [eax + edi], 0
mov ecx, dword [esi + 0xd0]
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
push ebp
mov dword [esi + 0xd8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [esi + 0xc8], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xc0], eax
mov dword [esi + 0xcc], eax
pop edi
pop esi
pop ebp
pop ecx
ret 4

Function at 0x401c50
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401c7f
pop edi
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xd4]
cmp eax, ecx
jb 0x401c91
mov eax, ecx
mov edx, dword [esi + 0xd0]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x402f60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x13c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x150]
lea ebx, [esi + 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x403169
cmp dword [esi], 1
jne 0x402fa4
cmp dword [esp + 0x154], 1
jne 0x402fa4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret 8
lea eax, [esp + 0x4c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x4c]
push str..bmp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 0
lea edx, [esp + 0x60]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x402ff3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x44]
push 0xe
push ecx
push ebp
call edi
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0x28
push eax
push ebp
call edi
cmp word [esp + 0x22], 0x10
je 0x403032
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret 8
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edi, edx
imul edi, ecx
cmp eax, 1
jne 0x403081
cmp dword [esp + 0x154], 0
je 0x40306a
cmp dword [esp + 0x154], 3
jne 0x403081
cmp ecx, dword [esi + 0x104]
jg 0x40306a
cmp edx, dword [esi + 0x108]
jle 0x403081
mov ecx, dword [esi + 0x10c]
push ecx
call fcn.00410bcc
add esp, 4
mov dword [esi], 0
jmp 0x403085
test eax, eax
jne 0x4030c5
lea edx, [edi + edi]
mov byte [ebx], 0
push edx
call fcn.00410bd7
mov edx, dword [esp + 0x154]
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [esi + 0x10c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x108], ecx
push edx
push ebx
mov dword [esi + 0x104], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x154], 2
jne 0x4030ee
cmp ecx, dword [esi + 0x104]
jg 0x4030df
cmp edx, dword [esi + 0x108]
jle 0x4030ee
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x13c
ret 8
add edi, edi
push edi
call fcn.00410bd7
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
xor edx, edx
test eax, eax
jle 0x40315a
mov edi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
jle 0x403155
sub eax, edx
mov ebp, dword [esi + 0x10c]
dec eax
imul eax, edi
mov edi, dword [esi + 0x104]
add eax, ecx
imul edi, edx
mov ax, word [ebx + eax*2]
add edi, ecx
inc ecx
mov word [ebp + edi*2], ax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jl 0x403126
inc edx
cmp edx, eax
jl 0x403120
push ebx
call fcn.00410bcc
add esp, 4
mov dword [esi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x13c
ret 8
Function at 0x404ee0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x404efa
mov dword [esi + 0x52eac8], eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x12]
push 0x41a23c
push ecx
call ebx
lea ebp, [esi + 0x18a48]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x404f45
mov ecx, 0x41
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
push ebp
call ebx
push str..cwl
push 0x41a0e0
mov dword [0xf130cc], 1
call ebx
push str..cwd
push 0x41a0e8
call ebx
push str.cwd_format____version_1.00__
push 0xf130d0
call ebx
mov dword [0x41a0f0], 0x259a
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x52eac8]
push eax
push ecx
push edx
lea ecx, [esi + 0x5c9460]
call fcn.00402010
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
lea ecx, [esi + 0x5c9020]
call fcn.00402c40
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
push edx
push eax
lea ecx, [esi + 0x5c9130]
call fcn.00402c40
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push ecx
push edx
lea ecx, [esi + 0x5c9240]
call fcn.00402c40
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
lea ecx, [esi + 0x5c9350]
call fcn.00402c40
mov edx, dword [esi + 0x52eac8]
lea ecx, [esi + 0x5c94f8]
push edx
call fcn.00404230
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 4
Function at 0x40b400
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
push edi
mov esi, ecx
call fcn.0040c790
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 8]
push 0x104
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [esi + 8], 1
jne 0x40b469
lea ecx, [esp + 0xb]
push str.Documents_and_Settings_
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esi + 0x52e9b8]
lea ecx, [esp + 8]
push eax
push ecx
call edi
push str.Application_DataAnim_
jmp 0x40b4bd
cmp dword [esi + 4], 1
jne 0x40b4b2
mov ecx, dword [esi + 0x52eac8]
push 0
lea eax, [esp + 0x114]
push 0x1a
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x110]
push 0x41a9c0
push edx
call edi
lea eax, [esp + 0x110]
lea ecx, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40b4c4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41a23c
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esi + 0x52ecd4]
lea ecx, [esp + 8]
push eax
push ecx
call edi
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.0040f6f0
cmp eax, 2
jne 0x40b4ee
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret
mov eax, dword [esi + 0x18a40]
mov ecx, dword [esi + eax*4 + 0x189f0]
lea eax, [esi + eax*4 + 0x189f0]
cmp ecx, 0xa
jge 0x40b516
mov ecx, dword [esi + 0x5c9018]
mov edx, dword [esi + ecx*4 + 0x189e8]
mov dword [eax], edx
push 1
mov ecx, esi
call fcn.00409f40
test eax, eax
jne 0x40b52c
pop edi
pop esi
add esp, 0x20c
ret
mov ecx, esi
call fcn.0040b120
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x20c
ret
Function at 0x40ca50
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00408470
mov edi, eax
mov ebx, 1
shl eax, 6
add eax, edi
mov dword [esp + 0x10], ebx
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 2
sub eax, edi
mov ebp, dword [esi + eax*8 + 0x5380b8]
mov eax, dword [esi + edi*4 + 0x18f34]
test eax, eax
jne 0x40caad
lea ecx, [edi + edi*2]
push ebp
lea eax, [edi + ecx*8]
lea edx, [eax + eax*4]
lea eax, [esi + edx*8 + 0x18f84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esi + edi*4 + FormatMessageA], ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40cad9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
cmp dword [esi + 8], ebx
jne 0x40cb14
lea edx, [esp + 0x17]
push str.Documents_and_Settings_
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esi + 0x52e9b8]
lea edx, [esp + 0x14]
push ecx
push edx
call ebx
push str.Application_DataAnim_
jmp 0x40cb67
cmp dword [esi + 4], ebx
jne 0x40cb5c
mov edx, dword [esi + 0x52eac8]
push 0
lea ecx, [esp + 0x11c]
push 0x1a
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x118]
push 0x41a9c0
push eax
call ebx
lea ecx, [esp + 0x118]
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40cb6e
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41a23c
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [esi + 0x52ecd4]
lea edx, [esp + 0x14]
push ecx
push edx
call ebx
lea edi, [esi + 0x1dda8]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.00401b80
test eax, eax
jne 0x40cb96
xor edx, edx
jmp 0x40cbab
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov ecx, edi
call fcn.00401fb0
mov edx, dword [esp + 0x10]
mov ecx, 0xfa
xor eax, eax
mov edi, ebp
test edx, edx
rep stosd dword es:[edi], eax
jne 0x40cbe4
push 0x41a830
push ebp
call ebx
add esi, 0x5c8c27
push esi
push ebp
call ebx
push 0x41ab48
push ebp
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esi + 0x52ebd0]
lea ecx, [esp + 0x14]
push eax
push ecx
call ebx
push 5
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esi + 0x52eac8]
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret
Function at 0x40d310
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x25868]
test eax, eax
jge 0x40d321
xor eax, eax
pop esi
ret
lea eax, [esi + 0x18a48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x40d334
pop esi
ret
cmp dword [esi + 0x25888], 0x64
jne 0x40d347
mov dword [esi + 0x25888], 0
mov ecx, dword [esi + 0x25868]
mov eax, dword [esi + 0x2587c]
cmp ecx, eax
jge 0x40d361
mov dword [esi + 0x5c901c], 0xe
cmp dword [esi + 0x5c901c], 0xa
jne 0x40d3a0
mov ecx, eax
shl ecx, 6
add ecx, eax
lea edx, [esi + ecx*4 + 0x258b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 0x2587c]
inc ecx
mov dword [esi + 0x2587c], ecx
mov ecx, dword [esi + 0x25868]
test ecx, ecx
jge 0x40d3a0
mov dword [esi + 0x5c901c], 0xe
push edi
mov edi, dword [esi + 0x5c901c]
cmp edi, 0xe
jne 0x40d3b8
mov dword [esi + 0x25880], 0x64
jmp 0x40d3d1
mov eax, dword [esi + 0x2587c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
inc ecx
idiv ecx
mov dword [esi + 0x25880], eax
cmp edi, 0xe
pop edi
jge 0x40d3ec
mov ecx, esi
call fcn.00409790
lea eax, [esi + 0x1de90]
mov ecx, esi
push eax
call fcn.0040a270
mov eax, 1
pop esi
ret
Function at 0x40e730
Capabilities:
Delete file

Disassembly:
sub esp, 0x3f4
push ebx
push ebp
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov eax, dword [ebx + 0x1de88]
xor edi, edi
cmp eax, edi
je 0x40e757
push eax
call esi
mov dword [ebx + 0x1de88], edi
mov eax, dword [ebx + 0x1de8c]
cmp eax, edi
je 0x40e76a
push eax
call esi
mov dword [ebx + 0x1de8c], edi
mov eax, dword [ebx + 0x25868]
cmp eax, edi
jl 0x40e865
mov ecx, eax
mov esi, 0xfffda748
shl ecx, 6
add ecx, eax
sub esi, ebx
inc eax
mov dword [esp + 0x10], esi
lea ebp, [ebx + ecx*4 + 0x258b8]
mov dword [esp + 0x14], eax
mov ecx, 0xfa
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebx + 0x18a48]
push eax
push edx
call edi
push 1
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40e7d1
push 2
mov ecx, ebx
call fcn.0040e960
test eax, eax
je 0x40e7df
lea eax, [ebx + 0x18b4c]
lea ecx, [esp + 0x1c]
push eax
push ecx
call edi
push ebp
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40e850
lea edx, [eax - 1]
test edx, edx
jl 0x40e831
mov ecx, 1
mov edi, 0x41a23c
lea esi, [edx + ebp]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40e811
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e824
cmp dword [esp + 0x18], 1
je 0x40e827
mov dword [esp + 0x18], 1
dec edx
jns 0x40e7f9
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esi + ebp]
add eax, edx
lea edx, [esp + 0x1c]
lea ecx, [eax + ebx + 0x258b9]
push ecx
push edx
call edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x14]
sub ebp, 0x104
dec eax
mov dword [esp + 0x14], eax
jne 0x40e796
mov eax, dword [ebx + 0x1dda4]
test eax, eax
jl 0x40e898
mov ecx, eax
shl ecx, 6
add ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
shl ecx, 2
sub ecx, eax
lea ecx, [ebx + ecx*8 + 0x5380c0]
cmp dword [ecx], 0
jne 0x40e898
dec eax
sub ecx, 0x79d8
test eax, eax
jge 0x40e888
mov ecx, eax
lea ebp, [ebx + 0x18a48]
shl ecx, 6
add ecx, eax
mov edi, 0x4fe0
lea ecx, [ecx + ecx*2]
lea edx, [ecx + ecx*4]
shl edx, 2
sub edx, eax
lea eax, [ebx + edx*8 + 0x5306ec]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x1c]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
mov ecx, ebx
call fcn.0040e960
test eax, eax
jne 0x40e8e6
push 2
mov ecx, ebx
call fcn.0040e960
test eax, eax
je 0x40e8fc
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebx + 0x18b4c]
lea eax, [esp + 0x1c]
push edx
push eax
call esi
jmp 0x40e902
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x79d4]
test eax, eax
je 0x40e942
cmp dword [edi + eax + 0x57d0], 1
jne 0x40e942
lea edx, [edi + eax + 0x5fac]
lea eax, [esp + 0x1c]
push edx
push eax
call esi
lea ecx, [esp + 0x1c]
push 0x41a23c
push ecx
call esi
lea edx, [esp + 0x1c]
push edx
call fcn.004019f0
add esp, 4
sub edi, 0x8e0
jns 0x40e8c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3f4
ret
Function at 0x40f5d0
Capabilities:
Delete file
Get common file path
Read file on windows

Disassembly:
sub esp, 0x108
xor eax, eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
mov ebx, ecx
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp dword [ebx + 8], 1
jne 0x40f630
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x13]
push str.Documents_and_Settings_
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebx + 0x52e9b8]
lea eax, [esp + 0x10]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
push str.Local_SettingsTemp_
push ecx
call esi
jmp 0x40f640
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x10]
push str.current.tmp
push eax
call esi
push 0
push 0x80
push 3
push 0
push 0
lea ecx, [esp + 0x24]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f687
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
lea eax, [esp + 0xc]
push 0
push eax
add ebx, 0x5ca5c8
push 0x104
push ebx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
push esi
test eax, eax
jne 0x40f6cf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x108
ret