joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4165d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x404
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x40c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x41c]
mov ebp, ecx
test ebx, ebx
je 0x416605
cmp byte [ebx], 0
je 0x416605
mov esi, ebx
jmp 0x416607
xor esi, esi
push edi
push 0xd0c
call fcn.00430730
push eax
push esi
call fcn.00412810
add esp, 0xc
call fcn.00411e60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x41669d
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416631
sub eax, edx
push edi
mov esi, eax
call fcn.00427f90
test al, al
jne 0x41666d
lea eax, [esp + 0x10]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416660
sub eax, edx
lea esi, [esi + eax + 1]
cmp esi, 0x104
jbe 0x41669d
test ebx, ebx
je 0x416682
cmp byte [ebx], 0
je 0x416682
mov esi, ebx
jmp 0x416684
xor esi, esi
push 0x104
push 0xe6e
call fcn.00430730
push eax
push esi
call fcn.00412810
add esp, 0xc
mov ecx, ebp
call fcn.00416340
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e316
add esp, 0x404
ret 8

Function at 0x4166e0
Capabilities:
Terminate process

Disassembly:
push esi
push 0xce6
mov esi, ecx
call fcn.00430730
push eax
push 0
push esi
call fcn.00416180
inc dword [0x45d408]
add esp, 0xc
mov dword [0x45d404], 8
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x41671a
call fcn.00435970
push 8
call fcn.0043fdf9
int3

Function at 0x416730
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0xce0
mov esi, ecx
call fcn.00430730
push eax
push 0
push esi
call fcn.00416180
add esp, 0x10
mov ecx, esi
call fcn.00416340
mov eax, dword [0x45d404]
test eax, eax
je 0x416763
cmp eax, 1
jne 0x41676d
mov dword [0x45d404], 2
inc dword [0x45d408]
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x416784
call fcn.00435970
push 2
call fcn.0043fdf9
int3

Function at 0x416790
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push esi
push eax
push 0xcde
mov esi, ecx
call fcn.00430730
mov ecx, dword [esp + 0xc]
push eax
push ecx
push esi
call fcn.00416180
add esp, 0x10
mov ecx, esi
call fcn.00416340
inc dword [0x45d408]
mov dword [0x45d404], 5
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x4167d9
call fcn.00435970
push 5
call fcn.0043fdf9
int3

Function at 0x416830
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0xd0e
mov esi, ecx
call fcn.00430730
push eax
push 0
call fcn.00412810
add esp, 0xc
call fcn.00411e60
mov ecx, esi
call fcn.00416340
inc dword [0x45d408]
mov dword [0x45d404], 6
call fcn.0041a970
cmp byte [esi + 0xa], 0
pop esi
je 0x41687a
call fcn.00435970
push 6
call fcn.0043fdf9
int3
Function at 0x419ba0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x44a4bb
mov eax, dword fs:[0]
push eax
mov eax, 0x24c4
call fcn.0043ec90
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x24c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4537b0]
xor eax, esp
push eax
lea eax, [esp + 0x24d4]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24e4]
mov esi, dword [esp + 0x24e8]
lea ecx, [esp + 0xc24]
call fcn.00436170
lea ecx, [esp + 0xc48]
call fcn.00436170
lea ecx, [esp + 0xc6c]
call fcn.00436170
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
call fcn.0041d3b0
test al, al
je 0x419dbb
cmp byte [esp + 0x10], 0
je 0x419dbb
cmp byte [esp + 0xc90], 0
je 0x419dbb
lea ecx, [esp + 0xc90]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00427330
push eax
call fcn.00434f30
test eax, eax
je 0x419dbb
lea eax, [esp + 0xc90]
push eax
push edi
call fcn.00427330
push eax
call fcn.00434f30
test eax, eax
jne 0x419dbb
xor esi, esi
lea ecx, [ecx]
push 0x400
push edi
lea ecx, [esp + 0x1cd8]
push ecx
call fcn.004351e0
push esi
push str.rtmp_d
lea edx, [esp + 0x1cd8]
push edx
call fcn.00427330
push eax
call fcn.0043e325
add esp, 0xc
push 0
lea eax, [esp + 0x1cd4]
push eax
call fcn.0041b210
test al, al
je 0x419ccd
add esi, 0x7b
cmp esi, 0x2710
jl 0x419c80
push 0
lea ecx, [esp + 0x1cd4]
push ecx
call fcn.0041b210
test al, al
jne 0x419dbb
push 0x400
push edi
lea edx, [esp + 0x20d8]
push edx
call fcn.004351e0
lea eax, [esp + 0x10]
push eax
call fcn.00427330
lea ecx, [esp + 0x20d0]
push ecx
mov esi, eax
call fcn.00427330
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x419d10
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x1cd0]
push edx
lea eax, [esp + 0x20d4]
push eax
call esi
test eax, eax
je 0x419dbb
lea ecx, [esp + 0x10b0]
call fcn.0041a0f0
push 0
push edi
mov dword [esp + 0x24e4], 0
xor bl, bl
call fcn.0041b210
test al, al
jne 0x419d72
push 1
push 0
push edi
lea ecx, [esp + 0x10bc]
call fcn.0041a640
mov bl, al
lea ecx, [esp + 0x20d0]
push ecx
lea edx, [esp + 0x1cd4]
push edx
call esi
test bl, bl
je 0x419da0
lea ecx, [esp + 0x10b0]
call fcn.0041a170
lea ecx, [esp + 0x10b0]
call fcn.0041a220
lea ecx, [esp + 0x10b0]
mov dword [esp + 0x24dc], 0xffffffff
call fcn.0041a4b0
mov al, 1
jmp 0x419dbd
xor al, al
mov ecx, dword [esp + 0x24d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24c0]
xor ecx, esp
call fcn.0043e316
add esp, 0x24d0
ret 8
Function at 0x41a4e0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
push edi
mov dword [esi + 0xc18], 0
mov al, 1
jne 0x41a4fc
mov al, byte [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
je 0x41a513
mov dword [esp + 0x1c], 0xc0000000
mov ebp, 1
test al, al
je 0x41a521
mov ebp, 3
xor eax, eax
cmp byte [esi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0041dc50
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x41a562
test ebx, ebx
je 0x41a562
cmp word [ebx], 0
je 0x41a562
mov ecx, dword [esp + 0x1c]
push 0
push edi
push 3
push 0
push ebp
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [esp + 0x14]
jmp 0x41a57a
mov edx, dword [esp + 0x1c]
push 0
push edi
push 3
push 0
push ebp
mov ebp, dword [esp + 0x28]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41a596
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x41a596
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne al
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [esp + 0x1c], al
test al, al
je 0x41a607
mov dword [esi + 4], edi
test ebx, ebx
je 0x41a5c9
push ebx
lea eax, [esi + 0x418]
push eax
call fcn.00436840
jmp 0x41a5d2
xor ecx, ecx
mov word [esi + 0x418], cx
lea edx, [esi + 0x17]
test ebp, ebp
je 0x41a5ec
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41a5e0
jmp 0x41a5f8
push 0x1000000
push edx
push ebx
call fcn.004365c0
mov eax, dword [esi + 4]
push eax
mov ecx, esi
call fcn.0041a140
mov al, byte [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x41a780
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x41a7a7
cmp edi, 0x4e20
jbe 0x41a79c
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a818
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x41a7f6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x41a7db
cmp eax, 3
jne 0x41a7f6
cmp edi, 0x4e20
jbe 0x41a7f6
push 0x4e20
push ebx
mov ecx, esi
call fcn.0041a780
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x41a80f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x41a80f
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x41ab90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x41ad96
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41abce
sub eax, 1
je 0x41abc3
sub eax, 1
jne 0x41abce
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x41abf0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x41abf0
mov ebx, dword [esp + 0x34]
jmp 0x41abf0
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x41ac44
xor edi, edi
test ebx, ebx
jbe 0x41ac69
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x41ac14
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x41ac69
add edi, 0x4000
cmp edi, ebx
jb 0x41ac04
jmp 0x41ac61
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x41ad90
cmp byte [esi + 0x14], 0
je 0x41ad90
cmp dword [esi + 0xc], 0
jne 0x41ad90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.0041a320
mov ebx, eax
lea eax, [esi + 0x17]
push eax
mov dword [esp + 0x2c], edx
call fcn.0041b0c0
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x41acf2
ja 0x41acba
cmp dword [esp + 0x1c], ebp
jbe 0x41acf2
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x41acf2
jl 0x41acd1
cmp edx, 0xffffffff
ja 0x41acf2
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x41acf2
jg 0x41ace4
cmp ecx, 0xffffffff
jbe 0x41acf2
lea eax, [esi + 0x17]
push eax
mov ecx, 0x45d404
call fcn.00416490
push 0
lea edi, [esi + 0x17]
push edi
mov ecx, 0x45d404
call fcn.00416120
test al, al
je 0x41ad80
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x41abe0
test eax, eax
jbe 0x41abe0
mov ecx, esi
call fcn.0041a320
mov ecx, dword [esp + 0x10]
xor ebx, ebx
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebx
cmp ecx, 0xffffffff
je 0x41abe0
mov ebx, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41abe0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41abe0
cmp byte [esi + 0x14], 0
je 0x41abe0
push edi
mov ecx, 0x45d404
call fcn.004164e0
jmp 0x41abe0
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, 0x45d404
call fcn.00416790
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x41b040
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.00427220
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x41b09c
cmp eax, 5
je 0x41b09c
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0043e316
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.0043e316
add esp, 0x404
ret 4

Function at 0x41b0c0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00427220
cmp dword [0x45bde0], 0
jne 0x41b11d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41b110
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45bde0], eax
cmp dword [0x45bde0], 0
je 0x41b19e
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.004277f0
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x45bde0]
test eax, eax
je 0x41b19e
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x41b19e
push 1
push 0
push 0
push eax
call fcn.0043eee0
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0043e316
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x41b1eb
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0043e316
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.0043e316
add esp, 0x42c
ret 4

Function at 0x41b210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0041dc50
test eax, eax
je 0x41b23b
mov eax, dword [esp + 8]
test eax, eax
je 0x41b23b
cmp word [eax], 0
je 0x41b23b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8

Function at 0x41b2c0
Capabilities:
Get file attributes

Disassembly:
call fcn.0041dc50
test eax, eax
je 0x41b2e1
mov eax, dword [esp + 8]
test eax, eax
je 0x41b2e1
cmp word [eax], 0
je 0x41b2e1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8
Function at 0x41b2f0
Capabilities:
Set file attributes

Disassembly:
call fcn.0041dc50
test eax, eax
je 0x41b31b
mov eax, dword [esp + 8]
test eax, eax
je 0x41b31b
cmp word [eax], 0
je 0x41b31b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc

Function at 0x41b490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
jmp 0x41b4a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b4a0
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x41b4b7
pop edi
xor eax, eax
pop ebx
ret 4
push ebp
push esi
call fcn.0043fe85
mov ebp, eax
lea eax, [ebx + edi - 6]
xor esi, esi
mov dword [esp + 0x14], eax
lea ebx, [ebx + edi - 4]
mov edi, edi
mov edx, dword [esp + 0x14]
lea ecx, [esi + ebp]
push ecx
push str._06u
push edx
call fcn.0043e325
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0041dc50
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41b505
cmp esi, 0x3e8
je 0x41b50e
inc esi
jmp 0x41b4d0
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret 4
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret 4

Function at 0x41b520
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.0043ec90
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0041dc50
test eax, eax
je 0x41b59a
test esi, esi
je 0x41b56b
cmp word [esi], 0
jne 0x41b575
test edi, edi
je 0x41b59a
cmp word [edi], 0
je 0x41b59a
lea eax, [esp + 0x10]
push eax
push edi
push ebp
call fcn.004272f0
push eax
lea ecx, [esp + 0x814]
push ecx
push esi
push ebx
call fcn.004272f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x41b5a2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.0043e316
add esp, 0x1004
ret 0x10
Function at 0x41b7a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc2c
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0xc28], eax
push esi
mov esi, dword [esp + 0xc38]
push edi
mov edi, dword [esp + 0xc38]
call fcn.0041dc50
test eax, eax
je 0x41b80b
test esi, esi
je 0x41b80b
cmp word [esi], 0
je 0x41b80b
lea eax, [esp + 0x42c]
push eax
push esi
call fcn.0041b3d0
lea ecx, [esp + 0x42c]
push ecx
call fcn.00436820
xor edx, edx
mov word [esp + eax*2 + 0x42e], dx
lea eax, [esp + 0x42c]
push eax
call fcn.0041b720
jmp 0x41b87a
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.0041b340
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b820
sub eax, edx
mov byte [esp + eax + 0x29], cl
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea ecx, [esp + 8]
mov edx, 0x54
lea eax, [esp + 0x28]
push ecx
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], dx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0xc30]
pop edi
pop esi
xor ecx, esp
call fcn.0043e316
add esp, 0xc2c
ret 8

Function at 0x41b910
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc30]
push esi
push edi
mov edi, dword [esp + 0xc3c]
push ebp
lea ebx, [esp + 0x420]
lea esi, [esp + 0x14]
call fcn.0041b8a0
test al, al
je 0x41b971
call fcn.0041dc50
test eax, eax
je 0x41b96a
cmp word [esp + 0x41c], 0
je 0x41b96a
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41b994
lea ecx, [esp + 0x10]
push ecx
jmp 0x41b98e
call fcn.0041dc50
test eax, eax
je 0x41b98d
test edi, edi
je 0x41b98d
cmp word [edi], 0
je 0x41b98d
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x41b994
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc30]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.0043e316
add esp, 0xc24
ret 8

Function at 0x41b9c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0041dc50
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x41b9e8
test esi, esi
je 0x41b9e8
cmp word [esi], 0
je 0x41b9e8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41b9f1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41ba0f
cmp byte [esp + 0x14], 0
je 0x41ba08
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.0041b2f0
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41ba24
cmp eax, 3
mov eax, 1
jne 0x41ba29
mov eax, 2
pop edi
pop esi
ret 0x10
Function at 0x41bcb0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0041dc50
test eax, eax
je 0x41be49
test esi, esi
je 0x41bd12
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x41bd17
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x41bd25
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x41bd2a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41bd3c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x41bd41
mov byte [esp + 0x13], 0
call fcn.0041dc50
test eax, eax
je 0x41bd61
test edi, edi
je 0x41bd61
cmp word [edi], 0
je 0x41bd61
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x41bd6c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x41be64
test al, 1
je 0x41be64
push 0
push edi
push ebp
mov bl, 1
call fcn.0041b2f0
lea ecx, [esp + 0x3c]
push ecx
push edi
push ebp
call fcn.004272f0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41be49
cmp byte [esp + 0x12], 0
je 0x41bdd1
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.00435e70
cmp byte [esp + 0x11], 0
je 0x41bde6
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00435e70
cmp byte [esp + 0x13], 0
je 0x41bdfb
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.00435e70
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x41be49
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.0041b2f0
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e316
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x41bd88
Function at 0x41be70
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44a59b
mov eax, dword fs:[0]
push eax
mov eax, 0x1cac
call fcn.0043ec90
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x1ca8], eax
push ebx
push esi
push edi
mov eax, dword [0x4537b0]
xor eax, esp
push eax
lea eax, [esp + 0x1cbc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1cd0]
mov edi, dword [esp + 0x1ccc]
push esi
push edi
call fcn.00427140
test al, al
je 0x41bf40
lea ecx, [esp + 0x10]
call fcn.0041ce00
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x1cc8], 0
call fcn.0041ce40
push esi
lea ecx, [esp + 0x14]
call fcn.0041ce90
lea ecx, [esp + 0x182c]
call fcn.00436170
lea ecx, [esp + 0x1850]
call fcn.00436170
lea ecx, [esp + 0x1874]
call fcn.00436170
push 0
lea eax, [esp + 0xc1c]
push eax
lea ecx, [esp + 0x18]
call fcn.0041d2a0
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x1cc4], 0xffffffff
call fcn.0041ce20
mov al, 1
jmp 0x41bf69
call fcn.0041dc50
test eax, eax
je 0x41bf5c
test esi, esi
je 0x41bf5c
cmp word [esi], 0
je 0x41bf5c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x41bf63
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x1cbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ca8]
xor ecx, esp
call fcn.0043e316
add esp, 0x1cb8
ret 8

Function at 0x41bfa0
Capabilities:
Set file attributes

Disassembly:
call fcn.0041dc50
test eax, eax
je 0x41bfc9
mov eax, dword [esp + 8]
test eax, eax
je 0x41bfc9
cmp word [eax], 0
je 0x41bfc9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [esp + 8], 0
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]