joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4303d0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x16], 0
mov dword [edi + 0xc18], 0
mov al, 1
jne 0x4303ec
mov al, byte [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
je 0x430403
mov dword [esp + 0x1c], 0xc0000000
mov ebp, 1
test al, al
je 0x430411
mov ebp, 3
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov esi, eax
call fcn.0043e7a0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x430452
test ebx, ebx
je 0x430452
cmp word [ebx], 0
je 0x430452
mov ecx, dword [esp + 0x1c]
push 0
push esi
push 3
push 0
push ebp
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [esp + 0x14]
jmp 0x43046a
mov edx, dword [esp + 0x1c]
push 0
push esi
push 3
push 0
push ebp
mov ebp, dword [esp + 0x28]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x430486
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x430486
mov dword [edi + 0xc18], 1
cmp esi, 0xffffffff
setne al
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov byte [esp + 0x1c], al
test al, al
je 0x43050a
mov dword [edi + 4], esi
test ebx, ebx
je 0x4304c5
lea edx, [edi + 0x418]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4304b4
jmp 0x4304ce
xor eax, eax
mov word [edi + 0x418], ax
test ebp, ebp
je 0x4304ec
lea edx, [edi + 0x17]
mov eax, ebp
sub edx, ebp
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4304e0
jmp 0x4304fb
push 0x1000000
lea ecx, [edi + 0x17]
push ecx
push ebx
call fcn.00472540
mov edx, dword [edi + 4]
push edx
mov ecx, edi
call fcn.0042ffe0
mov al, byte [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x4306b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x4306d7
cmp edi, 0x4e20
jbe 0x4306cc
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x430748
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x430726
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x43070b
cmp eax, 3
jne 0x430726
cmp edi, 0x4e20
jbe 0x430726
push 0x4e20
push ebx
mov ecx, esi
call fcn.004306b0
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x43073f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x43073f
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x430a50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x430c6e
mov eax, dword [esi + 0xc]
test eax, eax
je 0x430a8e
sub eax, 1
je 0x430a83
sub eax, 1
jne 0x430a8e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x430ab0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x430ab0
mov ebx, dword [esp + 0x34]
jmp 0x430ab0
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x430b04
xor edi, edi
test ebx, ebx
jbe 0x430b29
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x430ad4
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x430b29
add edi, 0x4000
cmp edi, ebx
jb 0x430ac4
jmp 0x430b21
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x430c68
cmp byte [esi + 0x14], 0
je 0x430c68
cmp dword [esi + 0xc], 0
jne 0x430c68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.004301e0
mov ebx, eax
lea eax, [esi + 0x17]
push eax
mov dword [esp + 0x2c], edx
call fcn.00431190
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x430bb9
ja 0x430b7a
cmp dword [esp + 0x1c], ebp
jbe 0x430bb9
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x430bb9
jl 0x430b91
cmp edx, 0xffffffff
ja 0x430bb9
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x430bb9
jg 0x430ba4
cmp ecx, 0xffffffff
jbe 0x430bb9
lea edx, [esi + 0x418]
push edx
lea eax, [esi + 0x17]
push eax
mov ecx, 0x4d56b4
call fcn.00428eb0
push 0
lea ebx, [esi + 0x418]
push ebx
lea edi, [esi + 0x17]
push edi
mov ecx, 0x4d56b4
call fcn.00428f30
test al, al
je 0x430c4f
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x430aa0
test eax, eax
jbe 0x430aa0
mov ecx, esi
call fcn.004301e0
mov ecx, dword [esp + 0x10]
xor ebp, ebp
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebp
cmp ecx, 0xffffffff
je 0x430aa0
mov ebp, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebp, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430aa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x430aa0
cmp byte [esi + 0x14], 0
je 0x430aa0
push ebx
push edi
mov ecx, 0x4d56b4
call fcn.00429010
jmp 0x430aa0
lea eax, [esi + 0x418]
push eax
lea ecx, [esi + 0x17]
push ecx
push 0
push 0
mov ecx, 0x4d56b4
call fcn.00429480
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x431090
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.004511e0
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x4310ec
cmp eax, 5
je 0x4310ec
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004a39f3
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.004a39f3
add esp, 0x404
ret 4

Function at 0x431110
Capabilities:
Get disk information

Disassembly:
sub esp, 0x804
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
lea ecx, [esp]
push ecx
push eax
call fcn.00452730
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x43116c
cmp eax, 5
je 0x43116c
xor eax, eax
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004a39f3
add esp, 0x804
ret 4
mov ecx, dword [esp + 0x800]
xor ecx, esp
mov eax, 1
call fcn.004a39f3
add esp, 0x804
ret 4

Function at 0x431190
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.004511e0
cmp dword [0x4d3094], 0
jne 0x4311ed
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4311e0
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d3094], eax
cmp dword [0x4d3094], 0
je 0x43126e
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.004518c0
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x4d3094]
test eax, eax
je 0x43126e
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x43126e
push 1
push 0
push 0
push eax
call fcn.004a4850
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004a39f3
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x4312bb
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004a39f3
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.004a39f3
add esp, 0x42c
ret 4
Function at 0x4312e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.004511e0
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4313cf
mov ecx, 0x4b9fac
lea eax, [esp]
jmp 0x431340
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x431360
test dl, dl
je 0x43135c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x431360
add eax, 2
add ecx, 2
test dl, dl
jne 0x431340
xor eax, eax
jmp 0x431365
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4313b3
mov ecx, str.FAT32
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x431391
test dl, dl
je 0x43138d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x431391
add eax, 2
add ecx, 2
test dl, dl
jne 0x431371
xor eax, eax
jmp 0x431396
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4313b3
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a39f3
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a39f3
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004a39f3
add esp, 0x50c
ret 4

Function at 0x4313f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043e7a0
test eax, eax
je 0x43141b
mov eax, dword [esp + 8]
test eax, eax
je 0x43141b
cmp word [eax], 0
je 0x43141b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x431437
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431437
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x431440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043e7a0
test eax, eax
je 0x431467
mov eax, dword [esp + 4]
test eax, eax
je 0x431467
cmp word [eax], 0
je 0x431467
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x4314d0
Capabilities:
Get file attributes

Disassembly:
call fcn.0043e7a0
test eax, eax
je 0x4314f1
mov eax, dword [esp + 8]
test eax, eax
je 0x4314f1
cmp word [eax], 0
je 0x4314f1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x431500
Capabilities:
Set file attributes

Disassembly:
call fcn.0043e7a0
test eax, eax
je 0x43152b
mov eax, dword [esp + 8]
test eax, eax
je 0x43152b
cmp word [eax], 0
je 0x43152b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x431547
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x431550
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
lea edx, [eax + 1]
jmp 0x431560
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x431560
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x431577
pop esi
xor eax, eax
pop ebx
ret 4
push ebp
push edi
call fcn.004a4d25
mov ebp, eax
lea eax, [ebx + esi - 6]
xor edi, edi
mov dword [esp + 0x14], eax
lea ebx, [ebx + esi - 4]
mov edi, edi
lea eax, [edi + ebp]
cdq
mov ecx, 0xf4240
idiv ecx
push edx
mov edx, dword [esp + 0x18]
push 0x4b9fb0
push edx
call fcn.004a3a02
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0043e7a0
test esi, esi
je 0x4315d1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4315d1
cmp edi, 0x3e8
je 0x4315da
inc edi
jmp 0x431590
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x4315f0
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0043e7a0
test eax, eax
je 0x43167f
test esi, esi
je 0x43163b
cmp word [esi], 0
jne 0x431645
test edi, edi
je 0x43167f
cmp word [edi], 0
je 0x43167f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.00451280
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.00451280
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x431687
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004a39f3
add esp, 0x1004
ret 0x10

Function at 0x4318f0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
mov ebx, dword [esp + 0xc30]
push edi
mov edi, dword [esp + 0xc30]
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00431820
test al, al
je 0x431955
call fcn.0043e7a0
test eax, eax
je 0x43194e
cmp word [esp + 0x414], 0
je 0x43194e
lea edx, [esp + 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431978
lea eax, [esp + 8]
push eax
jmp 0x431972
call fcn.0043e7a0
test eax, eax
je 0x431971
test ebx, ebx
je 0x431971
cmp word [ebx], 0
je 0x431971
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431978
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc28]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.004a39f3
add esp, 0xc24
ret 8
Function at 0x431ac0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0043e7a0
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x431ae8
test esi, esi
je 0x431ae8
cmp word [esi], 0
je 0x431ae8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x431af5
test edi, edi
je 0x431b28
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431b13
cmp byte [esp + 0x14], 0
je 0x431b0c
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00431500
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x431b28
cmp eax, 3
mov eax, 1
jne 0x431b2d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x431b40
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x431c6d
cmp byte [ebp], 0
je 0x431c6d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x431bf0
cmp byte [edi], 0x5c
jne 0x431bd2
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a5350
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.0043e7a0
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x431bc7
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.00431500
jmp 0x431bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x50c1b0], 0
je 0x431bea
push edi
mov ecx, 0x50c0b0
call fcn.00472ce0
mov edi, eax
jmp 0x431beb
inc edi
cmp byte [edi], 0
jne 0x431b80
cmp byte [esp + 0x420], 0
pop esi
jne 0x431c4f
push ebp
call fcn.00451430
movsx eax, byte [eax]
push eax
call fcn.00450e40
test al, al
jne 0x431c4f
call fcn.0043e7a0
push 0
push ebp
call ebx
test eax, eax
je 0x431c44
push 0
push 0
push ebp
call fcn.00431500
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a39f3
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a39f3
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a39f3
add esp, 0x408
ret 8
Function at 0x431c90
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x431dc4
cmp word [ebp], 0
je 0x431dc4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x431d3c
cmp word [edi + ebp], 0x5c
jne 0x431d32
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a5d13
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.0043e7a0
test eax, eax
je 0x431d2d
cmp word [esp + 0x14], 0
je 0x431d2d
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x431d27
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00431500
jmp 0x431d32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x431cd0
cmp byte [esp + 0x820], 0
pop esi
jne 0x431da6
push ebp
call fcn.00450dc0
movzx ecx, word [eax]
push ecx
call fcn.00450e40
test al, al
jne 0x431da6
call fcn.0043e7a0
test eax, eax
je 0x431da1
cmp word [ebp], 0
je 0x431da1
push 0
push ebp
call ebx
test eax, eax
je 0x431d9b
push 0
push ebp
push 0
call fcn.00431500
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a39f3
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a39f3
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a39f3
add esp, 0x808
ret 8
Function at 0x431e20
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0043e7a0
test eax, eax
je 0x431fbe
test esi, esi
je 0x431e82
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x431e87
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x431e95
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x431e9a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x431eac
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x431eb1
mov byte [esp + 0x13], 0
call fcn.0043e7a0
test eax, eax
je 0x431ed1
test edi, edi
je 0x431ed1
cmp word [edi], 0
je 0x431ed1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x431edc
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x431fd9
test al, 1
je 0x431fd9
push 0
push edi
push ebp
mov bl, 1
call fcn.00431500
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00451280
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x431fbe
cmp byte [esp + 0x12], 0
je 0x431f46
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.0046cc60
cmp byte [esp + 0x11], 0
je 0x431f5b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0046cc60
cmp byte [esp + 0x13], 0
je 0x431f70
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.0046cc60
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x431fbe
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00431500
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a39f3
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x431ef8

Function at 0x4320e0
Capabilities:
Set file attributes

Disassembly:
call fcn.0043e7a0
test eax, eax
je 0x432109
mov eax, dword [esp + 8]
test eax, eax
je 0x432109
cmp word [eax], 0
je 0x432109
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x432123
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x432130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
lea edx, [eax + 2]
jmp 0x432140
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432140
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, 6
ja 0x43215d
pop esi
xor eax, eax
pop ebx
ret 4
push ebp
push edi
call fcn.004a4d25
mov ebp, eax
xor edi, edi
jmp 0x432170
xor edx, edx
mov ecx, 0xf4240
lea eax, [edi + ebp]
div ecx
lea eax, [esi + ebx*2 - 0xc]
push edx
push str._06u
push eax
mov edx, 7
call fcn.00495900
mov edx, 0x2e
add esp, 0xc
mov word [esi + ebx*2 - 8], dx
call fcn.0043e7a0
test eax, eax
je 0x4321cd
test esi, esi
je 0x4321cd
cmp word [esi], 0
je 0x4321cd
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4321cd
cmp edi, 0x3e8
je 0x4321d6
inc edi
jmp 0x432170
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret 4