joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450ba0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ed7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov ebx, dword [eax + 0x64]
cmp ebx, 0xffffffff
jne 0x450cca
cmp dword [eax + 0x78], ebx
jne 0x450c9c
cmp dword [eax + 0x60], 0
jne 0x450c9c
lea ecx, [eax + 0x10]
mov eax, dword [ecx]
cmp dword [eax + 4], 0
jne 0x450c04
mov eax, dword [ecx + 4]
cmp dword [eax + 4], 0
je 0x450d5f
lea eax, [ebp - 0x14]
push eax
call fcn.0044c9d0
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00449e30
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00401a70
push ecx
mov eax, esp
lea ecx, [ebp - 0x1c]
mov dword [eax], 3
call fcn.0044a140
lea ecx, [ebp - 0x1c]
test al, al
je 0x450c92
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044a4d0
mov bl, al
test bl, bl
jne 0x450c74
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041b460
push eax
push 0xc
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0044c7c0
lea ecx, [ebp + 0xc]
call fcn.00401a70
lea ecx, [ebp - 0x1c]
call fcn.00449f00
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00449f00
jmp 0x450d5f
cmp ebx, 0xffffffff
jne 0x450cca
mov ecx, dword [eax + 0x60]
test ecx, ecx
je 0x450cb3
push ecx
call fcn.0053237d
add esp, 4
jmp 0x450cb6
mov eax, dword [eax + 0x78]
push eax
call fcn.005329d6
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x450d5f
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [edi]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov esi, dword [ecx + 0x1c]
mov ecx, edi
mov dword [ebp - 0x14], edx
call esi
test al, al
je 0x450d51
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x450d51
mov eax, dword [edi]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [eax + 0x1c]
cmp ecx, esi
jg 0x450d2e
mov eax, dword [ebp - 0x10]
jl 0x450d35
mov edx, dword [ebp + 8]
cmp eax, edx
jae 0x450d31
push ecx
push eax
mov ecx, edi
call ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
mov eax, edx
mov ecx, esi
push ecx
push eax
mov ecx, edi
call ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi]
push ecx
push dword [ebp - 0x10]
mov ecx, edi
call dword [eax + 0x1c]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x451c60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ef25
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.0044cea0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040dd20
mov ecx, dword [ebp + 8]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044cea0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040dd20
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x10]
mov edi, eax
test edi, edi
setne bl
or esi, 0xffffffff
mov ecx, dword [ecx]
test ecx, ecx
je 0x451ced
cmp ecx, esi
je 0x451cfc
mov eax, dword [ebp - 0x10]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x451cfc
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403d20
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
je 0x451d19
cmp eax, 0xffffffff
je 0x451d28
mov eax, dword [ebp - 0x14]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x451d28
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
test edi, edi
jne 0x451d3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451d60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ef6d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0044c9d0
mov eax, dword [ebp - 0x10]
or esi, 0xffffffff
mov dword [ebp - 4], 0
cmp dword [eax + 4], 0
jne 0x451dae
push str.Empty_filename_passed_to_function
jmp 0x451dcc
xor eax, eax
lea ecx, [ebp - 0x10]
push 1
push eax
mov word [ebp - 0x18], ax
push dword [ebp - 0x18]
call fcn.00409590
cmp eax, 0xffffffff
je 0x451dfc
push str.Broken_filename_passed_to_function
movaps xmm0, xmmword [0x591920]
lea eax, [ebp - 0x30]
push eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x591860
call fcn.00429430
add esp, 8
call fcn.0052a6aa
xor bl, bl
mov dword [eax], 0x16
jmp 0x451f16
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00423f50
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
call fcn.00425480
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
je 0x451e43
cmp eax, 0xffffffff
je 0x451e52
mov eax, dword [ebp - 0x14]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x451e52
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x451e75
cmp eax, 0xffffffff
je 0x451e84
mov eax, dword [ebp - 0x18]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x451e84
push 4
push 2
push dword [ebp - 0x18]
call fcn.00403d20
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0044fba0
add esp, 8
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
test ecx, ecx
je 0x451ed6
cmp ecx, 0xffffffff
je 0x451ee5
mov eax, dword [ebp - 0x14]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x451ee5
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
test ebx, ebx
je 0x451eed
mov bl, 1
jmp 0x451f16
cmp byte [ebp + 0xc], 0
jne 0x451ef7
xor bl, bl
jmp 0x451f16
lea eax, [ebp - 0x10]
push 0
push eax
cmp edi, 0xb7
jne 0x451f0c
call fcn.004543d0
jmp 0x451f11
call fcn.00451f70
mov bl, al
add esp, 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x451f33
cmp eax, 0xffffffff
je 0x451f42
mov eax, dword [ebp - 0x10]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x451f42
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403d20
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451f70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54efa5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
push 1
push 0x593444
push 2
call fcn.0040ca40
test al, al
je 0x451fd1
lea eax, [ebp - 0xe]
push eax
call fcn.004252c0
add esp, 4
mov ecx, esi
movzx eax, word [eax]
push 1
push eax
call fcn.004085e0
cmp eax, 3
jle 0x45211e
mov ecx, dword [esi]
cmp dword [ecx + 4], 2
jne 0x451fe8
mov eax, dword [ecx + 0xc]
cmp word [eax + ecx + 2], 0x3a
je 0x45211e
cmp byte [ebp + 0xc], 0
je 0x452063
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0044fba0
add esp, 8
push 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ecx]
test ecx, ecx
je 0x45203c
cmp ecx, 0xffffffff
je 0x45204b
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x45204b
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403d20
add esp, 0xc
test edi, edi
je 0x452063
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12]
push eax
call fcn.004252c0
add esp, 4
mov ecx, esi
movzx eax, word [eax]
push 1
push 0xffffffffffffffff
push eax
call fcn.00409aa0
cmp eax, 1
jl 0x45211e
push eax
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00409b40
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push 1
push eax
call fcn.00451f70
add esp, 8
test al, al
jne 0x4520ca
lea ecx, [ebp - 0x18]
xor bl, bl
call fcn.00401a70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
call fcn.004545c0
add esp, 8
test al, al
je 0x4520f7
lea ecx, [ebp - 0x18]
mov bl, 1
call fcn.00401a70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 0xd]
call fcn.004514f0
lea ecx, [ebp - 0x18]
mov bl, al
call fcn.00401a70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4543d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x254]
sub esp, 0x254
push 0xffffffffffffffff
push 0x54f3b5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6f9540]
xor eax, ebp
mov dword [ebp + 0x250], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x25c]
mov esi, dword [ebp + 0x260]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [eax]
test ecx, ecx
je 0x454427
cmp ecx, 0xffffffff
je 0x454427
lock inc dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
cmp dword [eax + 4], 2
jne 0x45449f
mov ecx, dword [eax + 0xc]
cmp word [ecx + eax + 2], 0x3a
jne 0x45449f
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp ecx, 1
je 0x454450
test ecx, ecx
jne 0x454463
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
and edx, 0x7fffffff
add ecx, 2
cmp ecx, edx
jbe 0x454477
mov eax, dword [eax + 4]
lea ecx, [ebp - 0x10]
push 1
add eax, 2
push eax
call fcn.0040b2c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, 0x5c
add ecx, eax
mov eax, dword [eax + 4]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
inc dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
add ecx, eax
mov eax, dword [eax + 4]
xor edx, edx
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0044fba0
add esp, 8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x454501
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4544d9
cmp eax, 0x20
jne 0x454501
lea eax, [ebp]
push eax
push ecx
mov ecx, dword [ebp - 0x14]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ecx]
test eax, eax
je 0x4544f3
cmp eax, 0xffffffff
je 0x4544f3
lock inc dword [ecx]
call fcn.00453530
add esp, 8
test al, al
cmovne ebx, dword [ebp]
test esi, esi
je 0x45450d
cmp ebx, 0xffffffff
setne al
mov byte [esi], al
cmp ebx, 0xffffffff
jne 0x454516
xor bl, bl
jmp 0x45451c
shr ebx, 4
and bl, 1
mov eax, dword [ebp - 0x14]
or esi, 0xffffffff
mov eax, dword [eax]
test eax, eax
je 0x45453d
cmp eax, esi
je 0x45454c
mov eax, dword [ebp - 0x14]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x45454c
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
test eax, eax
je 0x454569
cmp eax, 0xffffffff
je 0x454578
mov eax, dword [ebp - 0x10]
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x454578
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403d20
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.00524b20
lea esp, [ebp + 0x254]
pop ebp
ret
Function at 0x4545c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f3ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4545f2
mov dword [esi], 0
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0044fba0
add esp, 8
push 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test esi, esi
je 0x45462a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x45464a
cmp eax, 0xffffffff
je 0x454659
mov ecx, dword [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
setne cl
test cl, cl
jne 0x454659
push 4
push 2
push dword [ebp + 0xc]
call fcn.00403d20
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f5f5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4557be
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
jne 0x4557be
push str.Empty_filename_passed_to_function
movaps xmm0, xmmword [0x591920]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0x591860
movups xmmword [ebp - 0x24], xmm0
call fcn.00429430
add esp, 8
call fcn.0052a6aa
mov dword [eax], 0x16
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.0044cea0
xor ecx, ecx
mov dword [ebp - 4], 0
push 1
mov word [ebp - 0x10], cx
push ecx
push dword [ebp - 0x10]
mov ecx, eax
call fcn.00409590
mov ecx, dword [ebp + 8]
or edi, 0xffffffff
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ecx]
test ecx, ecx
je 0x45580d
cmp ecx, edi
je 0x45581c
mov eax, dword [ebp + 8]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x45581c
push 4
push 2
push dword [ebp + 8]
call fcn.00403d20
add esp, 0xc
cmp ebx, 0xffffffff
je 0x45582b
push str.Broken_filename_passed_to_function
jmp 0x455781
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.0044cea0
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
mov esi, eax
test esi, esi
setne bl
mov eax, dword [ecx]
test eax, eax
je 0x45586f
cmp eax, 0xffffffff
je 0x45587e
mov eax, dword [ebp + 8]
lock xadd dword [eax], edi
dec edi
setne al
test al, al
jne 0x45587e
push 4
push 2
push dword [ebp + 8]
call fcn.00403d20
add esp, 0xc
test esi, esi
jne 0x455894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455d10
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54aacd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0044fba0
add esp, 8
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040dd20
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp - 0x10]
setne bl
mov eax, dword [eax]
test eax, eax
je 0x455d7f
cmp eax, 0xffffffff
je 0x455d8e
mov ecx, dword [ebp - 0x10]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
setne cl
test cl, cl
jne 0x455d8e
push 4
push 2
push dword [ebp - 0x10]
call fcn.00403d20
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455f60
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6f9540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ebx
sub eax, ebx
je 0x455fd3
sub eax, 1
je 0x455fcb
sub eax, 2
je 0x455fc6
mov dword [esi], 0x57
mov dword [esi + 4], 2
xor al, al
jmp 0x456159
lea edi, [ebp - 0x54]
jmp 0x455fd6
lea eax, [ebp - 0x54]
mov dword [ebp - 0x48], eax
jmp 0x455fd6
lea ebx, [ebp - 0x54]
call fcn.00465930
mov ecx, dword [ebp - 0x38]
test eax, eax
jne 0x456082
lea eax, [ebp - 0x44]
push eax
call fcn.004613e0
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
push eax
call fcn.004658d0
lea ecx, [ebp - 0x44]
call fcn.004675b0
lea ecx, [ebp - 0x44]
mov word [ebp - 0x30], ax
call fcn.00463f80
lea ecx, [ebp - 0x44]
mov word [ebp - 0x2e], ax
call fcn.004614c0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x2a], ax
call fcn.004638b0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x28], ax
call fcn.00463ee0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x26], ax
call fcn.00465050
lea ecx, [ebp - 0x34]
mov word [ebp - 0x24], ax
call fcn.00463fe0
lea ecx, [ebp - 0x44]
mov word [ebp - 0x22], ax
call fcn.00461520
cdq
mov ecx, 7
idiv ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x2c], dx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
test eax, eax
jne 0x45611c
xor al, al
jmp 0x456159
push 1
lea eax, [ebp - 0x40]
push eax
call fcn.00467430
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.004613e0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x40]
call fcn.004658d0
lea ecx, [ebp - 0x3c]
call fcn.004675b0
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x20], ax
call fcn.00463f80
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x1e], ax
call fcn.004614c0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x1a], ax
call fcn.004638b0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x18], ax
call fcn.00463ee0
lea ecx, [ebp - 0x34]
mov word [ebp - 0x16], ax
call fcn.00465050
lea ecx, [ebp - 0x34]
mov word [ebp - 0x14], ax
call fcn.00463fe0
lea ecx, [ebp - 0x3c]
mov word [ebp - 0x12], ax
call fcn.00461520
cdq
mov ecx, 7
idiv ecx
lea ecx, [ebp - 0x40]
mov word [ebp - 0x1c], dx
call fcn.0045faa0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x455fbf
push edi
push ebx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x456157
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor al, al
mov dword [esi + 4], 2
jmp 0x456159
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00524b20
mov esp, ebp
pop ebp
ret
Function at 0x4565b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e72d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x6f9540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov ecx, esi
mov byte [ebp - 0xd], 0
call fcn.0044cc10
test al, al
je 0x456671
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0044c9d0
mov ecx, dword [eax]
mov eax, dword [ecx + 0xc]
movzx ecx, word [eax + ecx]
call fcn.0040d340
mov ebx, 1
lea ecx, [eax - 0x41]
mov eax, dword [ebp - 0x14]
shl ebx, cl
mov eax, dword [eax]
test eax, eax
je 0x456650
cmp eax, 0xffffffff
je 0x45665f
mov eax, dword [ebp - 0x14]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x45665f
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
and ebx, dword [ebp - 0x18]
setne al
neg ebx
sbb ebx, ebx
and ebx, 0x14
jmp 0x456736
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0044cea0
push 1
push str._UNC
push 7
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.0040ca40
test al, al
je 0x456704
mov eax, dword [ebp - 0x14]
push 1
push 7
mov ecx, dword [eax + 0xc]
mov ax, word [eax + ecx]
lea ecx, [ebp - 0x14]
mov word [ebp - 0x18], ax
push dword [ebp - 0x18]
call fcn.00409590
mov edx, eax
test edx, edx
jle 0x4566eb
mov eax, dword [ebp - 0x14]
push 1
mov ecx, dword [eax + 0xc]
mov ax, word [eax + ecx]
lea ecx, [ebp - 0x14]
mov word [ebp - 0x18], ax
lea eax, [edx + 1]
push eax
push dword [ebp - 0x18]
call fcn.00409590
mov ecx, eax
test ecx, ecx
jle 0x4566eb
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
dec eax
cmp ecx, eax
jne 0x456704
lea eax, [ebp - 0x14]
push eax
call fcn.00456940
add esp, 4
test al, al
je 0x456704
mov ebx, 0x10
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
test eax, eax
je 0x456724
cmp eax, 0xffffffff
je 0x456733
mov eax, dword [ebp - 0x14]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
setne al
test al, al
jne 0x456733
push 4
push 2
push dword [ebp - 0x14]
call fcn.00403d20
add esp, 0xc
mov al, byte [ebp - 0xd]
test al, al
je 0x456762
mov edx, dword [ebp + 0xc]
test bl, 0x10
mov ecx, 0x20000
mov esi, 0x40000
cmovne ecx, esi
mov dword [edx + 0x10], ebx
or ecx, dword [edx + 4]
or ecx, 0x400000
mov dword [edx + 4], ecx
or dword [edx], 0x560000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret