joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d9c28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005c264d
and dword [ebp - 4], 0
cmp dword [0x7169c4], 0
mov ebx, eax
jne 0x5d9cd9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5d9d8a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x668da0
push edi
call esi
test eax, eax
je 0x5d9d8a
push eax
call fcn.005c25db
mov dword [esp], 0x6682e8
push edi
mov dword [0x7169c4], eax
call esi
push eax
call fcn.005c25db
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x7169c8], eax
call esi
push eax
call fcn.005c25db
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x7169cc], eax
call esi
push eax
call fcn.005c25db
pop ecx
mov dword [0x7169d4], eax
test eax, eax
je 0x5d9cd9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005c25db
pop ecx
mov dword [0x7169d0], eax
mov eax, dword [0x7169d0]
cmp eax, ebx
je 0x5d9d31
cmp dword [0x7169d4], ebx
je 0x5d9d31
push eax
call fcn.005c2656
push dword [0x7169d4]
mov esi, eax
call fcn.005c2656
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5d9d31
test edi, edi
je 0x5d9d31
call esi
test eax, eax
je 0x5d9d28
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5d9d28
test byte [ebp - 0xc], 1
jne 0x5d9d31
or dword [ebp + 0x10], 0x200000
jmp 0x5d9d6a
mov eax, dword [0x7169c8]
cmp eax, ebx
je 0x5d9d6a
push eax
call fcn.005c2656
pop ecx
test eax, eax
je 0x5d9d6a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5d9d6a
mov eax, dword [0x7169cc]
cmp eax, ebx
je 0x5d9d6a
push eax
call fcn.005c2656
pop ecx
test eax, eax
je 0x5d9d6a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x7169c4]
call fcn.005c2656
pop ecx
test eax, eax
je 0x5d9d8a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5d9d8c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e11b0
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x618bf3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.EL_TPointerSingleton_class_EL_Environment_.0
mov dword [0x71a030], esi
lea eax, [esp + 0xb]
push eax
lea edx, [esp + 0xf]
lea ecx, [esi + 8]
push edx
mov dword [esp + 0x20], 0
mov dword [esi + 4], vtable.EL_TStringTable_wchar_t__32_.0
call fcn.005e0cf0
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], 0
mov word [esi + 0x54], cx
xor edx, edx
lea ecx, [esi + 0x90]
mov dword [esi], vtable.EL_Environment.1.0
mov dword [esi + 4], vtable.EL_Environment.0
push edx
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], 0
push 0x6874ac
mov byte [esp + 0x20], 1
mov word [ecx + 4], dx
call fcn.004033ce
lea eax, [esi + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x5e13c0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6e163c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x6e2bdc]
push ebx
push esi
push edi
jle 0x5e13f4
xor al, al
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b8641
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
test eax, eax
jl 0x5e1418
mov eax, dword [0x7171f8]
test eax, eax
je 0x5e143d
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x5e143d
mov eax, dword [0x7171fc]
test eax, eax
je 0x5e1433
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ebx, [edi*4]
lea eax, [ebx + 8]
cmp eax, 0x400
ja 0x5e1464
call fcn.005c8300
mov esi, esp
test esi, esi
je 0x5e147c
mov dword [esi], 0xcccc
add esi, 8
jmp 0x5e147c
push eax
call fcn.005b3680
add esp, 4
test eax, eax
je 0x5e147a
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
push ecx
call fcn.00421740
add esp, 0x10
cmp dword [ebp + 8], 0xffffffff
jne 0x5e14ae
mov ecx, dword [0x7169f4]
test ecx, ecx
je 0x5e14ae
push ecx
push 1
push eax
push esi
call fcn.005b7cae
mov edx, dword [0x7169f4]
push edx
jmp 0x5e14c8
mov ecx, dword [0x7169f0]
test ecx, ecx
je 0x5e14d0
push ecx
push 1
push eax
push esi
call fcn.005b7cae
mov eax, dword [0x7169f0]
push eax
call fcn.005b806b
add esp, 0x14
test esi, esi
je 0x5e14e9
cmp dword [esi - 8], 0xdddd
lea eax, [esi - 8]
jne 0x5e14e9
push eax
call fcn.005b3848
add esp, 4
mov al, 1
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b8641
mov esp, ebp
pop ebp
ret
Function at 0x5e1650
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
lea esi, [ebx + ebp]
call edx
cmp esi, eax
ja 0x5e16c1
mov ecx, dword [esp + 0x14]
call fcn.005e2c40
push 0
push esi
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [edi + 0x24], eax
test eax, eax
jne 0x5e16ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
call fcn.005e2d30
push eax
push str.CREATE_FILE_MAPPING_ERROR_diskFile_s__errno_lu_
push str.EL_MappedFile::Map
push 0x4f
push str..MappedFile.cpp
push 0xffffffffffffffff
push 0x200
call fcn.005e2b30
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
mov ecx, dword [0x71a030]
call fcn.005e0770
mov ecx, dword [edi + 0x24]
mov esi, eax
dec esi
and esi, ebx
lea eax, [esi + ebp]
push eax
sub ebx, esi
push ebx
push 0
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x5e1730
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
call fcn.005e2d30
push eax
push str.MAP_VIEW_OF_FILE_ERROR_diskFile_s__errno_lu_
push str.EL_MappedFile::Map
push 0x60
push str..MappedFile.cpp
push 0xffffffffffffffff
push 0x200
call fcn.005e2b30
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
add eax, esi
mov dword [edi + 0x18], ebp
mov dword [edi + 4], eax
mov dword [edi + 0x14], 0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
Function at 0x5e1b50
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
push esi
cmp edx, 0x10
jb 0x5e1cd3
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 1]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 2]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 3]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 4]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 5]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 6]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 7]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 8]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 9]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xa]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xb]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xc]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xd]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xe]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
movzx esi, byte [ecx + 0xf]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
add ecx, 0x10
sub edx, 0x10
cmp edx, 0x10
jae 0x5e1b65
test edx, edx
je 0x5e1cfb
jmp 0x5e1ce0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x6e2c60]
inc ecx
sub edx, 1
jne 0x5e1ce0
not eax
pop esi
ret
Function at 0x5e2780
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x668
mov eax, dword [0x6e163c]
xor eax, esp
mov dword [esp + 0x664], eax
mov eax, dword [esp + 0x66c]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x67c]
push eax
push 0x6691e4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x278]
push 0x200
push eax
call fcn.004210f0
mov ebp, 0x200
add esp, 0x10
sub ebp, eax
lea ebx, [esp + eax*2 + 0x270]
push 0x684f10
mov edx, ebp
mov ecx, ebx
call fcn.00421050
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x5e283c
test edi, edi
je 0x5e2822
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x45
mov ecx, edi
mov dword [esp + 0x1c], str.NO_FILES
mov dword [esp + 0x24], 0
call fcn.005e2620
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x664]
xor ecx, esp
call fcn.005b8641
add esp, 0x668
ret
push esi
lea ecx, [ecx]
cmp word [esp + 0x50], 0
lea esi, [esp + 0x50]
jne 0x5e2853
lea esi, [esp + 0x258]
push 1
push 0x684f04
push esi
call fcn.00420ee0
add esp, 0xc
test eax, eax
jne 0x5e288b
push 0x684f04
push esi
call fcn.00420e50
add esp, 8
test eax, eax
je 0x5e28e4
push 0x684efc
push esi
call fcn.00420e50
add esp, 8
test eax, eax
je 0x5e28e4
push esi
mov edx, ebp
mov ecx, ebx
call fcn.00421050
test byte [esp + 0x24], 0x10
je 0x5e28af
lea ecx, [esp + 0x274]
push edi
push ecx
call fcn.005e2780
add esp, 8
jmp 0x5e28e4
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x5e28e4
test edi, edi
je 0x5e28e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x278]
push eax
push str.DELETE_FILE_ERROR_filePath_s__errorCode_d_
push 0x45
push edi
call fcn.005e2700
add esp, 0x14
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5e2840
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5e2932
test edi, edi
je 0x5e2932
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.REMOVE_DIRECTORY_ERROR_dir_s__errorCode_d_
push 0x45
push edi
call fcn.005e2700
add esp, 0x14
mov ecx, dword [esp + 0x674]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.005b8641
add esp, 0x668
ret

Function at 0x5e2ca0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x28]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5e2cc8
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5e2cd6
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [esi + 0x28]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov al, 1
pop esi
ret 0xc
Function at 0x5e2cf0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 0x28]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5e2d14
xor al, al
ret 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x5e2d22
mov edx, dword [esp + 8]
mov dword [eax], edx
mov al, 1
ret 0xc

Function at 0x5e2de0
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
mov esi, ecx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5e2df0
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esi + 0xc]
call fcn.004033ce
mov ebx, dword [esp + 0x14]
movsx eax, bl
and eax, 2
or eax, 0xfffffffc
xor ecx, ecx
shl eax, 0x1d
cmp ebx, 1
setne cl
push 0
push 0x80
add ecx, 3
push ecx
push 0
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x28], eax
cmp eax, 0xffffffff
jne 0x5e2e4f
pop edi
mov dword [esi + 0x28], 0
pop esi
xor al, al
pop ebx
ret 8
push 0
push eax
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
mov dword [esi + 8], eax
pop esi
mov al, 1
pop ebx
ret 8

Function at 0x5e39a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x618e53
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.005e3680
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x717a04
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x681704
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.005e4850
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5e8b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x5e8b0f
mov eax, dword [eax + 4]
jmp 0x5e8b12
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5e8ba4
push esi
mov esi, dword [0x717a20]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
cmp eax, 2
je 0x5e8b89
cmp eax, 3
je 0x5e8b89
cmp eax, 0x7b
je 0x5e8b89
cmp eax, 0xf
je 0x5e8b89
cmp eax, 0x57
je 0x5e8b89
cmp eax, 0xa1
je 0x5e8b89
cmp eax, 0x35
je 0x5e8b89
cmp eax, 0x20
jne 0x5e8b7e
mov eax, dword [0x717a24]
mov dword [ecx], eax
mov edx, dword [0x717a28]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x717a24]
mov dword [ecx], eax
mov edx, dword [0x717a28]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x717a24]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x717a28]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x5e8bd1
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x5e8cc0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x5e8cdb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x5e8cf0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x5e8d0b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x5e8d40
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x5e8d53
mov ecx, dword [eax + 4]
jmp 0x5e8d56
lea ecx, [eax + 4]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], edx
jb 0x5e8d64
mov eax, dword [eax + 4]
jmp 0x5e8d67
add eax, 4
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x5e8d85
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [0x717a20]
mov dword [eax + 4], ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [0x717a20]
mov dword [eax + 4], ecx
ret
Function at 0x5e8da0
Capabilities:
Copy file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, 8
cmp dword [eax + 0x18], edx
jb 0x5e8db3
mov ecx, dword [eax + 4]
jmp 0x5e8db6
lea ecx, [eax + 4]
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], edx
jb 0x5e8dc4
mov eax, dword [eax + 4]
jmp 0x5e8dc7
add eax, 4
movzx edx, byte [esp + 0x10]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x5e8deb
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov ecx, dword [0x717a20]
mov dword [eax + 4], ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [0x717a20]
mov dword [eax + 4], ecx
ret

Function at 0x5e8f30
Capabilities:
Create directory

Disassembly:
sub esp, 8
push ebp
push esi
push edi
xor esi, esi
call fcn.005e9710
mov ebp, eax
mov dword [esp + 0xc], esi
call fcn.005e9710
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 8
mov dword [esp + 0x10], eax
jb 0x5e8f5b
mov eax, dword [edi + 4]
jmp 0x5e8f5e
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x5e8f7f
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 1
pop ebp
add esp, 8
ret
mov ebp, dword [0x717a20]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x5e8fcf
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.005e8b00
add esp, 0xc
cmp dword [esp + 0x1c], 3
jne 0x5e8fcf
mov eax, dword [esp + 0x18]
mov edx, dword [0x717a24]
mov ecx, dword [0x717a28]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x18]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebp
mov byte [eax + 8], 0
pop ebp
add esp, 8
ret

Function at 0x5e92c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x619178
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x5e92fb
mov edi, 1
push edi
call fcn.005b1f5c
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
push esi
push edi
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x5e932f
mov ebx, dword [0x717a20]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x24]
mov dword [edi + 4], ebx
jmp 0x5e935a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5e9334
mov ecx, dword [esp + 0x28]
sub eax, edx
push eax
push esi
call fcn.00402bfe
mov edi, dword [esp + 0x24]
mov ecx, dword [0x717a28]
mov eax, dword [0x717a24]
mov dword [edi + 4], ecx
push esi
mov dword [edi], eax
call fcn.005b293b
mov eax, edi
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x5e93a0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x6191ab
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x6e163c]
xor eax, esp
mov dword [esp + 0x278], eax
push ebp
push esi
push edi
mov eax, dword [0x6e163c]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x29c]
mov edx, dword [esp + 0x2b0]
mov edi, dword [esp + 0x2a0]
mov ebp, dword [esp + 0x2a8]
mov dword [esp + 0x14], ecx
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2a8]
push ecx
mov word [esp + 0x28], cx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
call fcn.0040384c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x294], 0
test eax, eax
je 0x5e946e
lea esi, [eax - 1]
cmp esi, eax
jbe 0x5e9453
call fcn.005b331a
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x5e9462
lea eax, [esp + 0x20]
cmp word [eax + esi*2], 0x5c
mov edx, 0x684f10
je 0x5e9473
mov edx, 0x684f08
mov eax, edx
lea esi, [eax + 2]
jmp 0x5e9480
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5e9480
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00402581
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x5e94ad
lea eax, [esp + 0x20]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x5e94ff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0
call esi
cmp eax, 2
jne 0x5e94d7
xor eax, eax
jmp 0x5e94d9
call esi
cmp dword [esp + 0x34], 8
mov esi, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [0x717a20]
mov dword [esi + 4], eax
jb 0x5e94fb
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005b2946
add esp, 4
mov eax, esi
jmp 0x5e957d
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5e9506
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x68]
push edx
mov ecx, ebp
call fcn.004033ce
test byte [esp + 0x38], 0x10
je 0x5e953f
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], 3
mov dword [ecx], 3
jmp 0x5e9553
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], 2
mov dword [eax], 2
mov ecx, dword [0x717a24]
mov edi, dword [esp + 0x10]
mov dword [edi], ecx
mov edx, dword [0x717a28]
mov dword [edi + 4], edx
cmp dword [esp + 0x34], esi
jb 0x5e957b
mov eax, dword [esp + 0x20]
push eax
call fcn.005b2946
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.005b8641
add esp, 0x288
ret