joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003dd00
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003dd30
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
test ebx, ebx
je 0x1003ddb0
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003dd98
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003dd68
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Current_set
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003dd13
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003dd68
mov eax, 0x10081b9c
jmp 0x1003dd68

Function at 0x1003ddc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003de10
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x1003de07
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
setne al
movzx eax, al
neg eax
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x1003de90
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003de78
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003de48
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Make_dir
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003ddd3
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003de48
mov eax, 0x10081b9c
jmp 0x1003de48

Function at 0x1003dea0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003ded0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
test ebx, ebx
je 0x1003df50
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003df38
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003df08
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Remove_dir
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003deb3
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003df08
mov eax, 0x10081b9c
jmp 0x1003df08
Function at 0x1003df60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test byte [0x10078b48], 8
jne 0x1003dfc8
test ebx, ebx
je 0x1003dfb8
test esi, esi
je 0x1003dfb8
mov eax, edi
mov dword [esp + 4], esi
movzx edi, al
mov dword [esp], ebx
mov dword [esp + 8], edi
call dword [sym.imp.kernel32.dll_CopyFileA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
jne 0x1003dfad
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 0x57
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx eax, al
mov dword [ebp - 0x14], eax
test esi, esi
je 0x1003e0c8
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x1003e090
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
mov dword [ebp - 0x10], 0x10081ba3
test eax, eax
jne 0x1003e013
mov edx, 0xffffffff
mov eax, esi
call fcn.10012f50
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x1003e0d8
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003e0b0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003e053
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov ecx, dword [ebp - 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__s__x__n
mov dword [esp + 8], str.tr2_sys__Copy_file
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003df7b
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
mov dword [ebp - 0x10], eax
jmp 0x1003e013
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003e053
mov dword [ebp - 0x10], 0x10081b9c
jmp 0x1003e013
mov eax, 0x10081b9c
jmp 0x1003e053
Function at 0x1003e0f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x10078b48], 8
jne 0x1003e158
test ebx, ebx
je 0x1003e148
test esi, esi
je 0x1003e148
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_MoveFileExA]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
jne 0x1003e139
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 0x57
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x1003e238
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x1003e208
mov dword [esp + 4], 0xffffffff
mov edi, 0x10081ba3
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
jne 0x1003e198
mov edx, 0xffffffff
mov eax, esi
call fcn.10012f50
mov edi, eax
test ebx, ebx
je 0x1003e248
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003e220
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003e1d4
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10081da0
mov dword [esp + 8], str.tr2_sys__Rename
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003e108
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
mov edi, eax
jmp 0x1003e198
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003e1d4
mov edi, 0x10081b9c
jmp 0x1003e198
mov eax, 0x10081b9c
jmp 0x1003e1d4
Function at 0x1003e260
Capabilities:
Get disk size

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x40
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x10078b48], 8
jne 0x1003e2b0
test esi, esi
jne 0x1003e315
mov dword [ebx + 0x10], 0
pxor xmm0, xmm0
mov eax, ebx
mov dword [ebx + 0x14], 0
movups xmmword [ebx], xmm0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test esi, esi
je 0x1003e390
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x1003e368
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
jne 0x1003e380
mov edx, 0xffffffff
mov eax, esi
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Statvfs
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
lea eax, [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
sub esp, 0x10
test eax, eax
je 0x1003e289
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
movq xmm0, qword [ebp - 0x28]
movhps xmm0, qword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x14], edx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003e2ed
mov dword [esp + 0x10], 0x10081ba3
jmp 0x1003e2f1
mov dword [esp + 0x10], 0x10081b9c
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Statvfs
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003e289
Function at 0x1003e3d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test byte [0x10078b48], 8
jne 0x1003e460
test esi, esi
je 0x1003e450
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x1003e4e8
and eax, 0x10
xor edx, edx
cmp eax, 1
sbb eax, eax
add eax, 3
mov dword [ebx], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x10081b9c
mov dword [esp + 0xc], 0x10081db5
mov dword [esp + 8], str.tr2_sys__Stat
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
mov edx, 0x57
xor eax, eax
mov dword [ebx], edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test esi, esi
je 0x1003e420
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x1003e4d0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
jne 0x1003e530
mov edx, 0xffffffff
mov eax, esi
call fcn.10012f50
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10081db5
mov dword [esp + 8], str.tr2_sys__Stat
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003e3eb
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003e495
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
cmp eax, 0x7b
je 0x1003e51d
ja 0x1003e548
cmp eax, 3
ja 0x1003e518
cmp eax, 1
ja 0x1003e51d
mov eax, dword fs:[0x18]
mov edx, dword [eax + 0x34]
xor eax, eax
jmp 0x1003e40d
cmp eax, 0x35
jne 0x1003e502
xor edx, edx
mov eax, 1
jmp 0x1003e40d
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x10081ba3
jmp 0x1003e49d
cmp eax, 0xa1
jne 0x1003e502
jmp 0x1003e51d
Function at 0x1003ec80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x47c
mov ebx, dword [ebp + 0xc]
test byte [0x10078b48], 8
jne 0x1003eda0
mov dword [esp], ebx
call dword [sym.imp.msvcr110.dll_wcslen]
cmp eax, 0x101
ja 0x1003ed88
mov eax, dword [sym.imp.msvcr110.dll_wcscpy]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x464]
mov dword [esp], ebx
mov dword [ebp - 0x468], eax
call eax
mov dword [esp + 4], 0x10081dce
mov dword [esp], ebx
call dword [sym.imp.msvcr110.dll_wcscat]
lea eax, [ebp - 0x25c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
sub esp, 8
mov edi, eax
cmp eax, 0xffffffff
je 0x1003ed88
mov esi, dword [sym.imp.msvcr110.dll_wcscmp]
lea ebx, [ebp - 0x230]
lea esi, cs:[esi]
mov dword [esp + 4], 0x10081dd4
mov dword [esp], ebx
call esi
test eax, eax
je 0x1003ed36
mov dword [esp + 4], 0x10081dd8
mov dword [esp], ebx
call esi
test eax, eax
jne 0x1003ee28
lea eax, [ebp - 0x25c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x1003ed10
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov word [eax], dx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [eax], 0xa1
mov eax, dword [ebp + 8]
mov word [eax], cx
jmp 0x1003ed76
test ebx, ebx
je 0x1003ee7d
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003ee68
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003ede0
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1c], ecx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], str.__p__s__p__p__n
mov dword [esp + 8], str.tr2_sys__Open_dir_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.10013100
jmp 0x1003ec9c
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp - 0x468]
call eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], 0
xor eax, eax
test byte [ebp - 0x25c], 0x10
setne al
add eax, 2
mov dword [ecx], eax
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003ede0
mov eax, 0x10081b9c
jmp 0x1003ede0
Function at 0x1003f9a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003f9d8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov edx, eax
sub esp, 4
xor eax, eax
test edx, edx
jne 0x1003f9d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x1003fa58
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003fa40
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003fa10
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Unlink
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003f9b3
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003fa10
mov eax, 0x10081b9c
jmp 0x1003fa10

Function at 0x1003fa60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003fa98
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov edx, eax
sub esp, 4
xor eax, eax
test edx, edx
jne 0x1003fa90
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x1003fb18
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003fb00
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003fad0
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Unlink_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003fa73
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003fad0
mov eax, 0x10081b9c
jmp 0x1003fad0

Function at 0x10040c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x10040c70
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
mov eax, 0
cmovne eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x10040cf0
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x10040cd8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x10040ca8
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Current_get_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10040c43
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x10040ca8
mov eax, 0x10081b9c
jmp 0x10040ca8
Function at 0x10040dc0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x10040df0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
test ebx, ebx
je 0x10040e70
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x10040e58
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x10040e28
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Current_set_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10040dd3
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x10040e28
mov eax, 0x10081b9c
jmp 0x10040e28

Function at 0x10040e80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x10040ed0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x10040ec7
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xb7
setne al
movzx eax, al
neg eax
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x10040f50
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x10040f38
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x10040f08
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Make_dir_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10040e93
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x10040f08
mov eax, 0x10081b9c
jmp 0x10040f08

Function at 0x10040f60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x10040f90
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov ebx, dword [ebp - 4]
sub esp, 4
test eax, eax
leave
setne al
ret
test ebx, ebx
je 0x10041010
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x10040ff8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x10040fc8
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Remove_dir_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10040f73
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x10040fc8
mov eax, 0x10081b9c
jmp 0x10040fc8
Function at 0x10041020
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 0xc]
movzx ebx, byte [ebp + 0x10]
test byte [0x10078b48], 8
jne 0x10041070
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CopyFileW]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
jne 0x10041061
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x10041168
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x10041130
mov dword [esp + 4], 0xffffffff
mov edi, 0x10081ba3
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x100410b0
mov edx, 0xffffffff
mov eax, esi
call fcn.10012d80
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10041178
mov eax, dword [ebp + 8]
shr eax, 0x10
test eax, eax
je 0x10041150
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x100410f8
mov eax, dword [ebp + 8]
mov edx, 0xffffffff
call fcn.10012d80
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__s__x__n
mov dword [esp + 8], str.tr2_sys__Copy_file_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10041039
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
mov edi, eax
jmp 0x100410b0
mov eax, dword [ebp + 8]
mov dword [esp], 0x10081bad
mov dword [esp + 4], eax
call fcn.10012ca0
jmp 0x100410f8
mov edi, 0x10081b9c
jmp 0x100410b0
mov eax, 0x10081b9c
jmp 0x100410f8
Function at 0x10041190
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x10078b48], 8
jne 0x100411e0
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_MoveFileExW]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
jne 0x100411d1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x100412c8
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x10041290
mov dword [esp + 4], 0xffffffff
mov edi, 0x10081ba3
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x10041220
mov edx, 0xffffffff
mov eax, esi
call fcn.10012d80
mov edi, eax
test ebx, ebx
je 0x100412d8
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x100412b0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1004125c
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012d80
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10081da0
mov dword [esp + 8], str.tr2_sys__Rename_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x100411a8
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
mov edi, eax
jmp 0x10041220
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1004125c
mov edi, 0x10081b9c
jmp 0x10041220
mov eax, 0x10081b9c
jmp 0x1004125c
Function at 0x100412f0
Capabilities:
Get disk size

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x40
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x10078b48], 8
jne 0x10041340
test esi, esi
jne 0x100413a5
mov dword [ebx + 0x10], 0
pxor xmm0, xmm0
mov eax, ebx
mov dword [ebx + 0x14], 0
movups xmmword [ebx], xmm0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test esi, esi
je 0x10041420
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x100413f8
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x10041410
mov edx, 0xffffffff
mov eax, esi
call fcn.10012d80
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Statvfs_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
lea eax, [ebp - 0x20]
mov dword [esp], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x10041319
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
movq xmm0, qword [ebp - 0x28]
movhps xmm0, qword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x14], edx
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 4], esi
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1004137d
mov dword [esp + 0x10], 0x10081ba3
jmp 0x10041381
mov dword [esp + 0x10], 0x10081b9c
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Statvfs_wchar
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x10041319