joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b701
Capabilities:
Get hostname

Disassembly:
cmp dword [0x496d90], 0
jne 0x42b70f
call fcn.0042af0b
push esi
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_gethostname]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42b743
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
pop edi
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, esi
pop esi
ret

Function at 0x42bc0b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], edi
jg 0x42bc32
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x42bd54
call sym.ruby187g.exc_rb_w32_osid
push 1
pop ebx
cmp eax, ebx
jne 0x42bc40
neg esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
mov eax, dword [ebp + 0xc]
jne 0x42bc77
cmp eax, edi
je 0x42bc77
cmp eax, 9
je 0x42bc77
push eax
call dword [sym.imp.MSVCRT.dll_raise]
mov esi, eax
pop ecx
cmp esi, edi
je 0x42bc70
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
mov eax, esi
jmp 0x42bd54
sub eax, edi
je 0x42bd22
dec eax
dec eax
je 0x42bcf0
sub eax, 7
je 0x42bc9d
call dword [sym.imp.MSVCRT.dll__errno]
or dword [ebp - 4], 0xffffffff
mov dword [eax], 0x16
jmp 0x42bd51
call sym.ruby187g.exc_rb_w32_enter_critical
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x42bcd7
cmp esi, 0xffffffff
je 0x42bcd7
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x42bcce
call dword [sym.imp.MSVCRT.dll__errno]
or dword [ebp - 4], 0xffffffff
mov dword [eax], ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42bd4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42bd40
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 3
jmp 0x42bd48
call sym.ruby187g.exc_rb_w32_enter_critical
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x42bd4c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x42bd40
call esi
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x42bd48
call sym.ruby187g.exc_rb_w32_enter_critical
push esi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
je 0x42bcd7
cmp eax, 0xffffffff
je 0x42bcd7
push eax
jmp 0x42bccf
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebx
or dword [ebp - 4], 0xffffffff
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42be08
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call sub.MSVCRT.dll_strlen
mov edi, eax
mov eax, dword [0x496d60]
test eax, eax
pop ecx
je 0x42be26
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test eax, eax
mov dword [0x496d60], eax
jne 0x42be47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
xor eax, eax
pop edi
pop esi
ret
cmp byte [eax], 0
mov esi, eax
je 0x42be42
push edi
push dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x42be67
cmp byte [esi + edi], 0x3d
je 0x42be7b
push esi
call sub.MSVCRT.dll_strlen
cmp byte [esi + eax + 1], 0
lea esi, [esi + eax + 1]
pop ecx
jne 0x42be4e
jmp 0x42be42
lea eax, [esi + edi + 1]
jmp 0x42be44

Function at 0x42be81
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ecx
and dword [esp], 0
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push ebp
call esi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
push edi
call esi
or esi, 0xffffffff
mov ebx, eax
cmp dword [esp + 0x18], esi
jne 0x42bec9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
mov eax, esi
jmp 0x42bf37
call sym.ruby187g.exc_rb_w32_enter_critical
cmp ebx, esi
je 0x42bee2
test bl, 1
je 0x42bee2
and ebx, 0xfffffffe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
push edi
push ebp
call ebx
test eax, eax
jne 0x42bf23
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
sub eax, 0x50
je 0x42bf06
sub eax, 0x67
jne 0x42bf59
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42bf3d
push 1
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x42bf59
and dword [esp + 0x10], 0
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42bf4f
call esi
cmp eax, 2
jne 0x42bf59
push edi
push ebp
call ebx
test eax, eax
je 0x42bf3d
jmp 0x42bf1e
call esi
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x42bf2e
Function at 0x42c0d5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x24
push 0
push esi
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
push 0x4844d4
push edi
mov word [esi + 8], 1
call sub.MSVCRT.dll__mbspbrk
add esp, 0x14
test eax, eax
je 0x42c11a
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 2
jmp 0x42c1b6
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x42c17f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push dword [ebp - 0x140]
call fcn.0042c243
mov word [esi + 6], ax
lea eax, [ebp - 0x134]
push eax
call fcn.0042c226
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0042c226
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0042c226
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x120]
add esp, 0x14
mov dword [esi + 0x14], eax
jmp 0x42c1c8
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42c1a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
jmp 0x42c1b6
test bl, 0x10
je 0x42c1bb
push edi
call fcn.0042c2f0
test eax, eax
pop ecx
je 0x42c1bb
or eax, 0xffffffff
jmp 0x42c221
push edi
push ebx
call fcn.0042c243
pop ecx
mov word [esi + 6], ax
pop ecx
mov eax, dword [sym.imp.MSVCRT.dll___mb_cur_max]
cmp dword [eax], 1
jle 0x42c1e5
movsx eax, byte [edi]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__isctype]
pop ecx
pop ecx
jmp 0x42c1f9
mov ecx, dword [sym.imp.MSVCRT.dll__pctype]
movsx eax, byte [edi]
mov ecx, dword [ecx]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x42c213
cmp byte [edi + 1], 0x3a
jne 0x42c213
movsx eax, byte [edi]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
sub eax, 0x41
jmp 0x42c21a
call dword [sym.imp.MSVCRT.dll__getdrive]
dec eax
mov dword [esi + 0x10], eax
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c41f
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42c436
call fcn.0042c495
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
ret
cmp dword [0x484208], 0xffffffff
jne 0x42c44a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x484208], eax
push ebx
push esi
push edi
push dword [0x484208]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, 0x484204
mov ebx, eax
push esi
call edi
test eax, eax
jle 0x42c483
test ebx, ebx
jne 0x42c483
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
jmp 0x42c467
inc ebx
push ebx
push dword [0x484208]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
ret
Function at 0x42c4b9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
call sym.ruby187g.exc_rb_w32_osid
cmp eax, 2
jne 0x42c4d0
call fcn.0042c495
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret
push 0x484204
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push dword [0x484208]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
dec eax
push eax
push dword [0x484208]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
ret

Function at 0x42c503
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
mov dword [ebp - 4], eax
call esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x49649c]
jne 0x42c537
xor eax, eax
jmp 0x42c691
push ebx
push edi
call sym.ruby187g.exc_rb_w32_interrupted
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [0x496498]
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
call ebx
push dword [0x496498]
call esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x2cc
lea eax, [ebp - 0x2e8]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x1000f
push eax
push dword [0x496498]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [0x496da0]
mov ecx, 0xb3
lea esi, [ebp - 0x2e8]
lea edi, [ebp - 0x5b4]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
cmp eax, ecx
jne 0x42c5c5
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x496da0], eax
jmp 0x42c5cc
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x496da0]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0042c694
push eax
lea eax, [ebp - 0x2e8]
push eax
call fcn.0042c6b5
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadContext]
add esp, 0x18
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x10001
push eax
push dword [0x496498]
call esi
push dword [0x496498]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x496da0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0
jne 0x42c680
call sym.ruby187g.exc_rb_w32_enter_critical
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10], 0
je 0x42c644
push dword [0x496498]
call ebx
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x5b4], 0x1000f
push eax
push dword [0x496498]
call esi
push dword [0x496498]
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
pop eax
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42c886
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
call sym.ruby187g.exc_rb_w32_enter_critical
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push esi
push eax
push 0x42c9d6
push esi
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
je 0x42c96d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
cmp dword [ebp - 0x20], esi
je 0x42c8dd
push 0xffffffffffffffff
push ebx
call fcn.0042c3d4
pop ecx
test eax, eax
pop ecx
je 0x42c90b
push dword [ebp + 0x18]
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x42c90b
push esi
call edi
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
pop edi
je 0x42c962
push 0x1c
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42c954
push 0x8000
push esi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 4
jmp 0x42c96d
call dword [sym.imp.MSVCRT.dll__errno]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
call sym.ruby187g.exc_rb_w32_leave_critical
cmp ebx, esi
jne 0x42c987
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_launch_waiter_thread:_d
call sym.ruby187g.exc_rb_fatal
cmp dword [ebp - 4], esi
je 0x42c9cf
cmp dword [sym.ruby187g.exc_rb_prohibit_interrupt], esi
jne 0x42c9c2
cmp dword [sym.ruby187g.exc_rb_thread_critical], esi
jne 0x42c9c2
cmp dword [sym.ruby187g.exc_rb_thread_pending], esi
jne 0x42c9b3
mov eax, dword [sym.ruby187g.exc_rb_thread_tick]
dec dword [sym.ruby187g.exc_rb_thread_tick]
test eax, eax
jg 0x42c9c2
mov dword [sym.ruby187g.exc_rb_thread_tick], 0x1f4
call sym.ruby187g.exc_rb_thread_schedule
cmp dword [sym.ruby187g.exc_rb_trap_pending], esi
je 0x42c9cf
call sym.ruby187g.exc_rb_trap_exec
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x42ca05
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
xor ebx, ebx
mov edi, esi
mov al, byte [esi]
test al, al
je 0x42ca30
cmp al, 0x3d
je 0x42ca21
inc ebx
push edi
call sub.MSVCRT.dll_strlen
lea edi, [edi + eax + 1]
pop ecx
mov al, byte [edi]
jmp 0x42ca18
lea eax, [ebx*4 + 4]
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
push eax
call ebx
cmp byte [esi], 0
mov ebp, eax
pop ecx
mov dword [esp + 0x10], ebp
mov edi, esi
je 0x42ca84
cmp byte [edi], 0x3d
je 0x42ca72
push edi
call sub.MSVCRT.dll_strlen
inc eax
push eax
call ebx
pop ecx
mov dword [ebp], eax
test eax, eax
pop ecx
je 0x42ca84
push edi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
add ebp, 4
pop ecx
push edi
call sub.MSVCRT.dll_strlen
cmp byte [edi + eax + 1], 0
lea edi, [edi + eax + 1]
pop ecx
jne 0x42ca4e
and dword [ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42cc19
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
push eax
call fcn.0042acf3
pop ecx
test eax, eax
pop ecx
jne 0x42cc45
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
pop ebp
ret
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.ruby187g.exc_rb_w32_recv
add esp, 0x10
pop ebp
ret
Function at 0x42cc9b
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
lea eax, [ebp - 0x34]
push edi
push eax
push dword [ebp + 8]
xor edi, edi
call sym.ruby187g.exc_rb_w32_stat
pop ecx
test eax, eax
pop ecx
jne 0x42cce1
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
cmp esi, edi
push eax
je 0x42cce9
push dword [esi]
call fcn.0042cdbd
pop ecx
test eax, eax
pop ecx
jne 0x42cce1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
call fcn.0042cdbd
pop ecx
test eax, eax
pop ecx
je 0x42ccfb
or eax, 0xffffffff
jmp 0x42cdb9
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push ebx
call sym.ruby187g.exc_rb_w32_enter_critical
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cd22
test bl, 1
je 0x42cd22
and al, 0xfe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call sym.ruby187g.exc_rb_w32_osid
dec eax
neg eax
sbb eax, eax
and eax, 0x2000000
push eax
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cd68
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov esi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], esi
or edi, 0xffffffff
jmp 0x42cd9d
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x42cd96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
or edi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x42cdb1
test bl, 1
je 0x42cdb1
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x42ce99
Capabilities:
Create directory
Delete directory

Disassembly:
push esi
or esi, 0xffffffff
call sym.ruby187g.exc_rb_w32_enter_critical
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42ceca
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll__chmod]
pop ecx
cmp eax, esi
pop ecx
je 0x42cee5
xor esi, esi
jmp 0x42ceef
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov edi, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], edi
pop edi
jmp 0x42ceef
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call sym.ruby187g.exc_rb_w32_leave_critical
mov eax, esi
pop esi
ret
Function at 0x42cef8
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187g.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cf26
test bl, 1
je 0x42cf26
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x42cf58
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x42cf58
test bl, 1
je 0x42cf58
push ebx
push esi
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x42cf64
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call sym.ruby187g.exc_rb_w32_enter_critical
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42cf92
test bl, 1
je 0x42cf92
and al, 0xfe
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x42cfc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby187g.exc_rb_w32_map_errno
pop ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
or ebp, 0xffffffff
cmp ebx, ebp
je 0x42cfc4
test bl, 1
je 0x42cfc4
push ebx
push esi
call edi
call sym.ruby187g.exc_rb_w32_leave_critical
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x42d914
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 4]
test eax, eax
jg 0x42d922
xor eax, eax
ret
cmp eax, dword [esp + 8]
jle 0x42d92c
mov eax, dword [esp + 8]
push ecx
push eax
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret
Function at 0x42ee26
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x404
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, sym.ruby187g.exc_rb_trap_immediate
mov eax, dword [esi + 4]
test eax, eax
jle 0x42ee9b
mov ecx, dword [esi]
mov edx, 0x400
cmp eax, edx
jbe 0x42ee55
mov eax, edx
movsx edx, byte [ecx]
cmp edx, dword [esp + 0x41c]
jne 0x42ef5a
lea edx, [eax - 1]
test edx, edx
je 0x42ee7d
movsx ebp, byte [ecx + 1]
inc ecx
cmp ebp, dword [esp + 0x41c]
jne 0x42ee7d
dec edx
jne 0x42ee6c
sub eax, edx
push esi
push eax
lea eax, [esp + 0x1c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x42ef41
jmp 0x42ee41
push esi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call sym.ruby187g.exc_rb_thread_wait_fd
push dword [esp + 0x420]
call sym.ruby187g.exc_rb_io_check_closed
push esi
call dword [sym.imp.MSVCRT.dll_clearerr]
add esp, 0x10
push 1
push ebx
call edi
push esi
mov ebp, eax
call sym.ruby187g.exc_rb_w32_getc
pop ecx
mov dword [esp + 0x10], eax
push ebp
push ebx
call edi
call dword [sym.imp.MSVCRT.dll__errno]
mov ebp, dword [eax]
xor eax, eax
cmp dword [sym.ruby187g.exc_rb_prohibit_interrupt], eax
jne 0x42ef14
cmp dword [sym.ruby187g.exc_rb_thread_critical], eax
jne 0x42ef14
cmp dword [sym.ruby187g.exc_rb_thread_pending], eax
jne 0x42ef05
mov eax, dword [sym.ruby187g.exc_rb_thread_tick]
dec dword [sym.ruby187g.exc_rb_thread_tick]
test eax, eax
jg 0x42ef14
mov dword [sym.ruby187g.exc_rb_thread_tick], 0x1f4
call sym.ruby187g.exc_rb_thread_schedule
cmp dword [sym.ruby187g.exc_rb_trap_pending], 0
je 0x42ef22
call sym.ruby187g.exc_rb_trap_exec
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], ebp
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x41c]
jne 0x42ef50
cmp eax, 0xffffffff
je 0x42ef5f
jmp 0x42ee41
mov eax, dword [esp + 0x418]
push dword [eax + 0x14]
call sym.ruby187g.exc_rb_sys_fail
push esi
push eax
call dword [sym.imp.MSVCRT.dll_ungetc]
pop ecx
pop ecx
push 2
pop eax
jmp 0x42ef61
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret