joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404680
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x18
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40479f
push ebp
push esi
mov ebp, 0xff
push 0x1fe
mov dword [esp + 0x10], ebp
call dword [sym.imp.MSVCR80.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x404792
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push esi
push 0
push edx
mov dword [esp + 0x30], ebp
call edi
test eax, eax
jne 0x404787
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
push ecx
call ebx
test eax, eax
jne 0x404786
mov edx, dword [esp + 0x10]
push esi
push edx
call fcn.00404680
add esp, 8
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push ecx
call ebx
test eax, eax
jne 0x404786
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x1c]
je 0x404786
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push esi
push 0
push edx
mov dword [esp + 0x34], ebp
call edi
test eax, eax
je 0x404700
pop ebx
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
pop edi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x18
ret
Function at 0x4047c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x43c510]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x404809
mov eax, 0x80004005
jmp 0x404910
call dword [0x43c4f0]
mov edx, dword [ebp + 0x14]
push edx
mov ebx, eax
call fcn.00404410
mov edi, eax
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], edi
call fcn.0040c830
mov esi, dword [ebp + 0x18]
push esi
push edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0040c530
test al, al
jne 0x40485b
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 1
jmp 0x404910
test esi, esi
jne 0x404863
xor eax, eax
jmp 0x404890
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x404878
xor eax, eax
jmp 0x404890
lea edi, [eax + eax]
mov eax, edi
call fcn.0042fd60
mov eax, esp
push ebx
push edi
push esi
push eax
call fcn.00404340
mov edi, dword [ebp - 0x18]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4048ff
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x4048c7
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4048cb
xor eax, eax
jmp 0x4048e0
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00404340
push 4
lea edx, [ebp + 0x20]
push edx
push 4
push 0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
xor eax, eax
lea esp, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc34
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x404940
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x43c510]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x404989
mov eax, 0x80004005
jmp 0x404a79
call dword [0x43c4f0]
mov edx, dword [ebp + 0x14]
push edx
mov ebx, eax
call fcn.00404410
mov esi, eax
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], esi
call fcn.0040c830
mov edi, dword [ebp + 0x18]
push edi
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0040c530
test al, al
jne 0x4049db
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 1
jmp 0x404a79
test edi, edi
jne 0x4049e3
xor eax, eax
jmp 0x404a10
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4049f8
xor eax, eax
jmp 0x404a10
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00404340
mov esi, dword [ebp - 0x18]
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404a68
mov edx, dword [ebp + 0x20]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404a37
mov ecx, dword [ebp + 0x1c]
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [ebp - 0x14]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
xor eax, eax
lea esp, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc34
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x404aa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430af8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x43c510]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
je 0x404c74
call dword [0x43c4f0]
mov edx, dword [ebp + 0x14]
push edx
mov dword [ebp - 0x14], eax
call fcn.00404410
mov esi, eax
add esp, 4
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], esi
call fcn.0040c830
mov edi, dword [ebp + 0x18]
push edi
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.0040c530
test al, al
jne 0x404b36
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 1
jmp 0x404c79
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x404b56
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 0x57
jmp 0x404c79
cmp word [eax], 1
jne 0x404c65
cmp dword [eax + 4], 1
jne 0x404c65
cmp dword [eax + 0x14], 0
jne 0x404c65
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov esi, eax
test esi, esi
je 0x404b9b
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, esi
jmp 0x404c79
test edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x404ba9
xor eax, eax
jmp 0x404bd2
push edi
call ebx
add eax, 1
cmp eax, 0x3fffffff
jle 0x404bba
xor eax, eax
jmp 0x404bd2
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov edx, dword [ebp - 0x14]
mov eax, esp
push edx
push esi
push edi
push eax
call fcn.00404340
mov edx, dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404c48
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x404c08
push edi
call ebx
add eax, 1
cmp eax, 0x3fffffff
jle 0x404c0c
xor eax, eax
jmp 0x404c24
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov ecx, dword [ebp - 0x14]
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.00404340
mov edx, dword [ebp + 0x20]
mov ecx, dword [edx + 0x10]
mov edx, dword [ebp - 0x20]
push ecx
push edx
push 3
push 0
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x20]
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
xor eax, eax
jmp 0x404c79
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 0x80004005
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc34
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x404ca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430af8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x43c510]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x404ce9
mov eax, 0x80004005
jmp 0x404e47
call dword [0x43c4f0]
mov edi, dword [ebp + 0x20]
xor esi, esi
cmp edi, esi
mov ebx, eax
mov dword [ebp - 0x20], ebx
jne 0x404d02
mov dword [ebp - 0x14], esi
jmp 0x404d30
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x404d18
mov dword [ebp - 0x14], esi
jmp 0x404d30
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00404340
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.00404410
mov esi, eax
add esp, 4
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], esi
call fcn.0040c830
mov edi, dword [ebp + 0x18]
push edi
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.0040c530
test al, al
jne 0x404d7a
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
mov eax, 1
jmp 0x404e47
test edi, edi
jne 0x404d82
xor eax, eax
jmp 0x404daf
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x404d97
xor eax, eax
jmp 0x404daf
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00404340
mov esi, dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404e36
mov eax, dword [ebp - 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404dd4
mov edi, dword [ebp + 0x1c]
sub eax, edx
test edi, edi
mov ebx, eax
je 0x404df9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x404dfd
xor eax, eax
jmp 0x404e15
lea esi, [eax + eax]
mov eax, esi
call fcn.0042fd60
mov edx, dword [ebp - 0x20]
mov eax, esp
push edx
push esi
push edi
push eax
call fcn.00404340
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ebx, 1
push ebx
push ecx
push 3
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c110
xor eax, eax
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042fc34
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x405270
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push esi
push edi
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x405292
pop edi
mov eax, 0x80004005
pop esi
ret 0x18
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00408f10
add esp, 8
test al, al
jne 0x4052b4
pop ebx
pop edi
mov eax, 0x57
pop esi
ret 0x18
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0x24]
push edx
push ebx
push esi
push edi
push eax
mov eax, dword [ecx + 0x60]
call eax
test eax, eax
jne 0x4052e3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
add eax, 1
pop ebx
pop edi
pop esi
ret 0x18

Function at 0x4052f0
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x405318
mov eax, 0x80004005
pop ecx
ret 0x1c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.00408f10
add esp, 8
test al, al
jne 0x405337
mov eax, 0x57
pop ecx
ret 0x1c
mov edx, dword [esp + 0xc]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x405355
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
ret 0x1c
cmp dword [esp + 0x20], 0
jne 0x405371
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp]
mov dword [ecx], edx
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
xor eax, eax
pop ecx
ret 0x1c
cmp dword [esp], 0
je 0x405380
mov eax, 1
pop ecx
ret 0x1c
cmp eax, 0x7fffffff
ja 0x405377
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
xor eax, eax
pop ecx
ret 0x1c
Function at 0x4053a0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x4053c0
mov eax, 0x80004005
pop ecx
ret 0x1c
mov eax, dword [esp + 0x14]
lea edx, [esp]
push edx
push eax
call fcn.00408f10
add esp, 8
test al, al
jne 0x4053de
mov eax, 0x57
pop ecx
ret 0x1c
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
push esi
je 0x405471
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405471
push ebx
mov ebx, dword [esp + 0x24]
push ebx
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
test eax, eax
mov dword [esi], eax
jne 0x405416
pop ebx
pop esi
mov eax, 0x80004005
pop ebp
pop ecx
ret 0x1c
push edi
lea ecx, [esp + 0x1c]
push ecx
push eax
xor edi, edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x405467
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push ebp
push ebx
push edx
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40544b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test edi, edi
je 0x405467
mov edx, dword [esi]
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov dword [esi], 0
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 0x1c
pop esi
mov eax, 0x57
pop ebp
pop ecx
ret 0x1c

Function at 0x405480
Capabilities:
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x4054a0
mov eax, 0x80004005
pop ecx
ret 0x18
mov eax, dword [esp + 0x14]
lea edx, [esp]
push edx
push eax
call fcn.00408f10
add esp, 8
test al, al
jne 0x4054be
mov eax, 0x57
pop ecx
ret 0x18
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
push esi
je 0x405534
mov esi, dword [esp + 0x20]
test esi, esi
je 0x405534
cmp word [esi], 1
jne 0x405529
cmp dword [esi + 4], 1
jne 0x405529
cmp dword [esi + 0x14], 0
jne 0x405529
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov edi, eax
test edi, edi
jne 0x405522
mov ecx, dword [esp + 0xc]
push eax
mov dword [ebx], eax
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x1c]
push ebx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x405519
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0x18
pop esi
mov eax, 0x80004005
pop ebx
pop ecx
ret 0x18
pop esi
mov eax, 0x57
pop ebx
pop ecx
ret 0x18
Function at 0x405540
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x430b58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
call dword [0x43c4f0]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x40559a
mov eax, 0x80004005
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
mov esi, dword [esp + 0x40]
xor edi, edi
cmp esi, edi
je 0x405610
lea ecx, [esp + 0xc]
call fcn.0040c830
push edi
push 1
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], edi
call fcn.0040c5c0
test al, al
jne 0x4055ea
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
lea eax, [edi + 1]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4055fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
jmp 0x405615
mov edi, 1
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10

Function at 0x405630
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x430bb8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
call dword [0x43c4f0]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
push ebp
push edi
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x40567d
mov eax, 0x80004005
jmp 0x40574a
lea ecx, [esp + 0x14]
call fcn.0040c830
mov eax, dword [esp + 0x4c]
push 0
push 1
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0
call fcn.0040c5c0
test al, al
je 0x405734
mov ecx, dword [esp + 0x50]
push 0
push 1
push ecx
lea ecx, [esp + 0x20]
call fcn.0040c5c0
test al, al
je 0x405734
mov ebx, dword [esp + 0x48]
mov eax, dword [ebx]
mov esi, dword [esp + 0x3c]
mov edx, dword [esi]
mov ecx, dword [edx + 0x30]
push eax
push ebp
push edi
push esi
call ecx
mov edi, eax
test edi, edi
jne 0x40571f
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
push edx
push eax
call dword [sym.imp.MSVCR80.dll__wrename]
add esp, 8
mov edi, eax
test edi, edi
push ebx
push 1
jne 0x40570c
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x48]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x2c]
push edx
push ebp
push eax
push esi
call ecx
mov edi, eax
jmp 0x40571f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x48]
mov edx, dword [esi]
mov edx, dword [edx + 0x2c]
push eax
push ebp
push ecx
push esi
call edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0xffffffff
call fcn.0040c110
mov eax, edi
jmp 0x40574a
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0xffffffff
call fcn.0040c110
mov eax, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x18
Function at 0x405820
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x430b58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
call dword [0x43c4f0]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x40587a
mov eax, 0x80004005
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
mov esi, dword [esp + 0x40]
xor edi, edi
cmp esi, edi
je 0x4058ef
lea ecx, [esp + 0xc]
call fcn.0040c830
push edi
push edi
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], edi
call fcn.0040c5c0
test al, al
jne 0x4058c9
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
lea eax, [edi + 1]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4058dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
jmp 0x4058f4
mov edi, 1
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10

Function at 0x405910
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x430b58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x43c510]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
call dword [0x43c4f0]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.0040bc10
add esp, 8
test eax, eax
jne 0x40596a
mov eax, 0x80004005
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
mov esi, dword [esp + 0x40]
xor edi, edi
cmp esi, edi
je 0x405a20
lea ecx, [esp + 0xc]
call fcn.0040c830
push 1
push edi
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], edi
call fcn.0040c5c0
test al, al
jne 0x4059be
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
lea eax, [edi + 1]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4059c3
sub eax, edx
sar eax, 1
je 0x405a08
movzx ecx, word [esi + eax*2 - 2]
cmp cx, 0x2e
je 0x405a08
cmp eax, 1
jbe 0x4059f2
cmp word [esi + eax*2 - 4], 0x2e
jne 0x4059f2
cmp cx, 0x5c
je 0x405a08
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x405a0d
mov edi, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c110
jmp 0x405a25
mov edi, 1
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 0x10