joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1907
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], ebx
movzx eax, word [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c0]
movzx ebp, ax
test ecx, ecx
je 0x4e1969
mov ebx, ecx
mov byte [esp + 0x27], 3
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4e1944
sub ebx, edx
lea eax, [esp + 0x29]
push ebx
push ecx
push eax
mov byte [esp + 0x34], bl
call fcn.0065afc0
add esp, 0xc
mov word [esp + ebx + 0x29], bp
xor ebx, ebx
jmp 0x4e199a
push esi
call fcn.004669ff
test al, al
je 0x4e1986
mov eax, dword [esi + 0xc]
mov byte [esp + 0x27], 1
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], bp
jmp 0x4e199a
push edi
mov byte [esp + 0x2b], 4
lea edi, [esp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [esp + 0x3c], bp
pop edi
lea eax, [esp + 0x24]
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.004e1a3d
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
add ecx, 0x118
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.0047a9b6
push ebx
push ebx
push dword [esp + 0x18]
lea eax, [esp + 0x138]
mov dword [esp + 0x18], ebx
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1d0]
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
test esi, esi
jne 0x4e1a15
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
cmp esi, eax
je 0x4e1a31
lea ecx, [esp + 0x24]
call fcn.004e1a3d
cmp esi, eax
jg 0x4e1a2d
xor eax, eax
jmp 0x4e1a31
sub esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1a0
ret 0x14

Function at 0x4e1c05
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x7b8660], 0
je 0x4e1c1b
mov al, 1
jmp 0x4e1c53
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4e1c51
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x4e1c4b
shr eax, 8
cmp al, 2
jne 0x4e1c4b
mov byte [0x7b8660], 1
jmp 0x4e1c17
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4ec0d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x18
mov eax, 0x6a8bcd
call fcn.006426c4
sub esp, 0xf0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp + 0x18], esi
mov ebx, dword [esi + 0x364]
call fcn.004ec281
mov esi, dword [esi + 0x140]
lea edi, [ebp + 4]
push 5
pop ecx
mov dword [ebp], 0x32716572
add esi, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xfc]
call fcn.0046ac9f
and dword [ebp - 4], 0
lea eax, [ebp]
push 0x18
push eax
lea ecx, [ebp - 0xfc]
call fcn.0046ac3b
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
mov esi, ebx
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, edi
mov eax, dword [ebx + ecx + 0x14]
xor dword [ebp + ecx - 0x74], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4ec13b
movzx eax, byte [0x78dad4]
mov esi, dword [ebp + 0x18]
mov ecx, esi
shr eax, 2
not eax
mov dword [ebp - 0x58], edi
and eax, 1
mov dword [ebp - 0x60], edi
or al, 2
mov dword [ebp - 0x5c], edi
mov byte [ebp - 0x55], al
mov byte [ebx], al
lea eax, [ebp - 0x50]
push dword [esi + 0x140]
mov dword [ebp - 0x54], 0x44000000
push eax
call fcn.004e62c6
mov eax, dword [esi + 0x140]
mov ecx, esi
push 0x14
add eax, 8
push eax
call fcn.004ed6f4
lea eax, [ebx + 0xc]
push eax
push 0x54
lea eax, [ebp - 0x60]
push eax
call fcn.00577208
lea eax, [ebx + 0x114]
mov dword [ebx + 5], edi
push eax
lea ecx, [ebx + 1]
push 8
push ecx
mov dword [ecx], edi
call fcn.00577208
push edi
push 0x7c
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.0047b976
lea ecx, [ebp - 0xfc]
call fcn.0040e6e4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x1c]
pop ebp
ret

Function at 0x4f2f1f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6a8f56
call fcn.006426c4
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebx], 0x6e47c4
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x14]
push 5
pop ecx
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 1
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebx + 0x10], eax
push edi
call fcn.00495a63
mov ecx, eax
mov esi, edx
mov eax, dword [0x7b1578]
cdq
add ecx, eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x28], ecx
adc esi, edx
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], 0xea60
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
lea esi, [ebx + 0x4c]
mov dword [esi], 0x6e46bc
push str.share
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.00473fd0
push esi
push eax
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 4
call fcn.00545077
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.004285f6
push 0x1388
call fcn.00460621
mov ecx, ebx
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x8c], edi
call fcn.004f418d
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4f5427
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x140], 0
jne 0x4f549c
mov ebx, 0x100
cmp dword [esi + 0x15c], ebx
jae 0x4f549c
lea edx, [esi + 0x144]
mov byte [esi + 0x140], 1
xor eax, eax
mov edi, edx
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0x158]
mov ecx, dword [esi + 0x15c]
sub ebx, ecx
mov edx, dword [esi]
mov edi, dword [esp + 0x14]
push eax
lea eax, [esi + 0x160]
mov dword [esi + 0x154], edi
add eax, ecx
mov ecx, esi
push ebx
push eax
call dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4f54a4
push edi
mov byte [esi + 0x140], 0
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov al, 1
pop edi
pop esi
pop ebx
ret 4
xor al, al
jmp 0x4f549e
Function at 0x505d2c
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x6aa02c
call fcn.006426c4
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x505d55
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
jmp 0x505d59
mov eax, ebx
mov edx, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x34]
push 7
pop edi
mov dword [esi + 4], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x505d98
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x4c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x505dad
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov al, byte [ebp + 0x2c]
mov byte [esi + 0x65], al
mov al, byte [esi + 0x66]
and al, 0xe1
mov byte [esi + 0x64], 8
or al, 0x40
mov word [esi + 0x67], bx
mov byte [esi + 0x66], al
lea eax, [esi + 0x6c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x505dda
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ecx
mov byte [esi + 0x90], bl
mov dword [esi + 0x94], ebx
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0050662b
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00427fbe
mov ecx, esi
call fcn.00508316
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov ecx, dword [esi + 0x8c]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x505e55
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.005072ed
push eax
lea ecx, [ebp - 0x28]
call fcn.00428071
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004285f6
lea eax, [ebp - 0x28]
push eax
call fcn.00461896
test al, al
je 0x505e82
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x505e6e
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
shl al, 5
xor al, byte [esi + 0x66]
and al, 0x20
xor byte [esi + 0x66], al
jmp 0x505e86
and byte [esi + 0x66], 0xdf
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004285f6
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x5068f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x6b10e9
call fcn.006426c4
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x9c
mov eax, dword [edi + 8]
sub eax, dword [edi + 4]
cdq
idiv ecx
test eax, eax
je 0x5069b6
push esi
xor esi, esi
mov eax, dword [edi + 4]
mov ecx, edi
add eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.005072ed
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x506946
lea eax, [ebp - 0x24]
push eax
call fcn.004618ab
test al, al
jne 0x50695a
mov eax, dword [edi + 4]
and byte [esi + eax + 0x66], 0xdf
jmp 0x50698c
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x506966
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x506984
mov ecx, dword [edi + 4]
shl al, 5
xor al, byte [esi + ecx + 0x66]
and al, 0x20
xor byte [esi + ecx + 0x66], al
jmp 0x50698c
mov eax, dword [edi + 4]
or byte [esi + eax + 0x66], 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
push 0
push 1
call fcn.004285f6
mov eax, dword [edi + 8]
mov ecx, 0x9c
sub eax, dword [edi + 4]
inc ebx
cdq
add esi, ecx
idiv ecx
cmp ebx, eax
jb 0x506925
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x506d16
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
sub esp, 0x64
mov eax, 0x6aa13b
call fcn.006426c4
sub esp, 0x30
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [ecx + 8]
cmp esi, edi
je 0x506ee1
add ecx, 0x28
mov dword [ebp + 0x48], ecx
push ebx
push 0
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [ebp]
push eax
call fcn.00460a53
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x506d5a
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x4c]
call fcn.00429d77
push 0
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004285f6
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
mov ebx, ecx
cmp edx, 8
jae 0x506d83
lea ebx, [ebp + 0x4c]
mov eax, dword [ebp + 0x5c]
sub eax, dword [esi + 0x44]
lea ebx, [ebx + eax*2]
add ebx, 0xfffffffe
mov dword [ebp + 0x64], ebx
cmp edx, 8
jae 0x506d9a
lea ecx, [ebp + 0x4c]
push 0x5c
push ecx
call fcn.0065d51b
pop ecx
pop ecx
cmp eax, ebx
jb 0x506ebf
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x506dbd
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x506eb4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
jne 0x506eb4
push str.thumbs.db
lea ecx, [ebp + 0x30]
call fcn.00429d77
push 0
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00460a53
cmp dword [eax + 0x14], 8
jb 0x506e09
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x24]
push 0
push 1
setne bh
call fcn.004285f6
push 0
push 1
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 2
call fcn.004285f6
push str..DS_Store
lea ecx, [ebp + 0x18]
call fcn.00429d77
push 0
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00460a53
cmp dword [eax + 0x14], 8
jb 0x506e5d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x3c]
push 0
push 1
setne bl
call fcn.004285f6
push 0
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 2
call fcn.004285f6
test bh, bh
jne 0x506e8d
test bl, bl
je 0x506ebf
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x506e99
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x506eb1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
je 0x506ebf
mov ebx, dword [ebp + 0x64]
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
jmp 0x506d92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x4c]
push 0
push 1
call fcn.004285f6
mov ecx, dword [ebp + 0x48]
add esi, 0x9c
cmp esi, edi
jne 0x506d3e
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
lea esp, [ebp + 0x68]
pop ebp
ret
Function at 0x506ef2
Capabilities:
Delete file

Disassembly:
mov eax, 0x6aa183
call fcn.006426c4
sub esp, 0x78
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004618ab
test al, al
je 0x50708f
push ebx
xor ebx, ebx
push esi
cmp byte [ebp + 0xc], bl
je 0x506ff4
push edi
call fcn.0046178e
mov esi, eax
test esi, esi
je 0x50708d
call fcn.00493cf6
push eax
push 0x21
lea ecx, [ebp - 0x1c]
call fcn.00493752
push edi
push str.fileName
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0049a954
push esi
push str.error
lea ecx, [ebp - 0x1c]
call fcn.0049a954
lea eax, [ebp - 0x1c]
push eax
call fcn.00495553
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00493803
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.0048941f
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.0044494c
push eax
xor esi, esi
lea eax, [ebp - 0x3c]
push str._to_trash_:1___error_code_:
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00428dbb
push ebx
push esi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.0040f95f
push str.deletefail
lea ecx, [ebp - 0x24]
call fcn.0040f32f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x21
call fcn.00489021
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.0040f95f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push esi
call fcn.0040f95f
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x50708d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.0048941f
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.00476d4a
push eax
push str._to_trash_:0___error_code_:
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 5
push eax
call fcn.00428dbb
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.0040f95f
push str.deletefail
lea ecx, [ebp - 0x54]
call fcn.0040f32f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x21
call fcn.00489021
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040f95f
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.0040f95f
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x5079ce
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x507a60
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x507a4f
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.005072ed
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x507a16
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
or eax, 1
cmp dword [esp + 0x24], 8
jae 0x507a2f
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.004285f6
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x5079ef
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret

Function at 0x507a69
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x507afb
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x507aea
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.005072ed
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x507ab1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
and eax, 0xfffffffe
cmp dword [esp + 0x24], 8
jae 0x507aca
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.004285f6
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x507a8a
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x507e13
Capabilities:
Move file

Disassembly:
mov eax, 0x6b10e9
call fcn.006426c4
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
call fcn.00506a6a
imul ecx, dword [ebp + 8], 0x9c
mov eax, dword [ebx + 4]
add eax, ecx
mov dword [ebp + 8], ecx
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.005072ed
and dword [ebp - 4], edi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x507e57
lea eax, [ebp - 0x24]
push eax
call fcn.004618ab
mov esi, dword [ebp + 0xc]
test al, al
je 0x507e92
cmp dword [esi + 0x14], 8
jb 0x507e6e
mov ecx, dword [esi]
jmp 0x507e70
mov ecx, esi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x507e7c
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x507e92
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x507eab
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00427fbe
mov eax, dword [ebx + 4]
mov ecx, ebx
add eax, dword [ebp + 8]
push eax
call fcn.0050836d
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x507ecc
Capabilities:
Move file

Disassembly:
mov eax, 0x6aa1f8
call fcn.006426c4
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
xor ebx, ebx
push ebx
call fcn.00506a6a
mov al, byte [esi + 0x89]
mov ecx, esi
test al, al
jne 0x507f57
call fcn.00508cb8
mov edi, 0x70000001
test al, al
je 0x507f2d
mov edx, dword [esi + 4]
lea ecx, [esi + 0x28]
push 1
mov al, byte [edx + 0x66]
shr al, 2
and al, 1
movzx eax, al
push eax
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [edx + 0x34]
push eax
push dword [ebp + 0x20]
call fcn.00507b04
mov ebx, eax
jmp 0x507f2f
mov ebx, edi
test ebx, ebx
je 0x507f3b
cmp ebx, edi
jne 0x508055
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x20]
call fcn.00427fbe
push dword [esi + 4]
mov ecx, esi
call fcn.0050836d
jmp 0x50803b
call fcn.00508cb8
test al, al
je 0x508036
and dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
jae 0x507f84
lea eax, [ebp + 8]
lea edi, [esi + 0x28]
cmp dword [edi + 0x14], 8
jb 0x507f91
mov ecx, dword [edi]
jmp 0x507f93
mov ecx, edi
push eax
push ecx
push str.Moving_files_from__s_to__s
call fcn.0047d5f0
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 8
jae 0x507fae
lea ecx, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x507fb8
mov eax, dword [edi]
jmp 0x507fba
mov eax, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x507fe2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x507ff4
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.005080a7
mov ebx, eax
test ebx, ebx
jne 0x508028
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004285f6
jmp 0x50803b
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x508000
lea eax, [ebp + 8]
push eax
call fcn.004626bc
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x508012
lea eax, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x50801a
mov edi, dword [edi]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x507fe2
jmp 0x507fd1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004285f6
jmp 0x508055
mov ebx, 0x70000001
call fcn.00479151
lea eax, [ebp + 8]
lea ecx, [esi + 0x28]
push eax
call fcn.00428071
mov byte [ebp - 4], 2
call fcn.00479192
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004285f6
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x5080a7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x6aa212
call fcn.006426c4
sub esp, 0x50
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, 0x9c
mov dword [ebp - 0x14], ebx
push edi
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
add eax, 1
je 0x5081f9
lea edi, [esi + 0x28]
and dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
test ebx, ebx
jne 0x508126
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.004949f9
push eax
lea eax, [ebp - 0x5c]
push str._sPartFile__LX.dat
push eax
call fcn.00465d7f
add esp, 0x14
lea ecx, [ebp - 0x2c]
push eax
call fcn.00428071
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.004285f6
mov byte [ebp - 0x10], bl
jmp 0x508157
imul edi, ebx, 0x9c
lea ecx, [ebp - 0x2c]
mov ebx, dword [esi + 4]
lea eax, [ebx - 0x68]
add eax, edi
cmp ecx, eax
je 0x508145
push 0xffffffffffffffff
push 0
push eax
call fcn.00428762
mov al, byte [edi + ebx - 0x36]
lea edi, [esi + 0x28]
mov ebx, dword [ebp - 0x14]
shr al, 2
and al, 1
mov byte [ebp - 0x10], al
push 0
lea eax, [ebp - 0x2c]
push eax
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.00427fbe
lea eax, [ebp - 0x44]
push eax
call fcn.00460bac
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
mov byte [ebp - 4], 1
jae 0x508183
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5081a6
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x50819b
lea ecx, [ebp - 0x44]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 1
push dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
push edi
push eax
push eax
call fcn.00507b04
push 0
lea ecx, [ebp - 0x44]
mov edi, eax
push 1
call fcn.004285f6
lea ecx, [ebp - 0x2c]
push 0
push 1
test edi, edi
jne 0x508215
or dword [ebp - 4], 0xffffffff
call fcn.004285f6
mov eax, dword [esi + 8]
lea edi, [esi + 0x28]
sub eax, dword [esi + 4]
mov ecx, 0x9c
cdq
inc ebx
idiv ecx
mov dword [ebp - 0x14], ebx
inc eax
cmp ebx, eax
jne 0x5080d8
mov ecx, esi
call fcn.00506d16
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004285f6
mov eax, edi
jmp 0x508202