joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ad30
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x23c
test eax, eax
push ebp
mov ebp, dword [esp + 0x244]
push esi
push edi
je 0x42ad57
push ebp
push str.download_set_path___s_
call fcn.0043bb00
add esp, 8
test ebp, ebp
je 0x42ad61
cmp byte [ebp], 0
jne 0x42ad66
mov ebp, str.objects.activefastso.not_aw
mov edx, dword [0x4e3a1c]
test edx, edx
je 0x42adad
push ebx
mov esi, ebp
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x42ad99
test cl, cl
je 0x42ad95
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x42ad99
add eax, 2
add esi, 2
test cl, cl
jne 0x42ad75
xor eax, eax
jmp 0x42ad9e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
jne 0x42adad
pop edi
pop esi
pop ebp
add esp, 0x23c
ret
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xc8
jbe 0x42adcb
pop edi
pop esi
pop ebp
add esp, 0x23c
ret
test edx, edx
je 0x42add9
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
push ebp
call fcn.0046ade0
push eax
mov dword [0x4e3a1c], eax
call fcn.0042af40
mov esi, dword [sym.imp.MSVCRT.dll__mkdir]
push 0x4e3914
call esi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x4e3914
lea eax, [esp + 0x58]
push str._s_textures_
push eax
call edi
lea ecx, [esp + 0x60]
push ecx
call esi
push 0x4e3914
lea edx, [esp + 0x68]
push str._s_seqs
push edx
call edi
lea eax, [esp + 0x70]
push eax
call esi
push 0x4e3914
lea ecx, [esp + 0x78]
push str._s_sounds
push ecx
call edi
lea edx, [esp + 0x80]
push edx
call esi
push 0x4e3914
lea eax, [esp + 0x188]
push str._sdownload
push eax
call edi
mov eax, dword [0x4e3a28]
add esp, 0x48
test eax, eax
je 0x42ae71
push eax
call fcn.004277d0
add esp, 4
mov esi, 1
push 0
push esi
push 0x1000
push 0x1000
push 0x32
lea ecx, [esp + 0x15c]
push 0x32
push ecx
call fcn.004273e0
mov ecx, dword [0x4c64f0]
mov edx, eax
mov eax, dword [str.CacheVersion]
mov dword [esp + 0x34], ecx
mov cl, byte [0x4c64f8]
mov dword [esp + 0x30], eax
mov eax, dword [0x4c64f4]
mov byte [esp + 0x3c], cl
mov dword [esp + 0x38], eax
mov ecx, 9
mov eax, 0x20202020
lea edi, [esp + 0x3d]
rep stosd dword es:[edi], eax
push edx
mov dword [0x4e3a28], edx
stosb byte es:[edi], al
call fcn.00427e00
add esp, 0x20
test eax, eax
jne 0x42af16
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
mov edx, dword [0x4e3a28]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
call fcn.00427900
add esp, 0x10
test eax, eax
je 0x42af08
cmp dword [esp + 0xc], esi
je 0x42af16
mov eax, dword [0x4e3a28]
push eax
call fcn.004271e0
add esp, 4
mov eax, dword [0x4e3a28]
lea ecx, [esp + 0xc]
push 4
lea edx, [esp + 0x18]
push ecx
push edx
push eax
mov dword [esp + 0x1c], esi
call fcn.00427b00
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x23c
ret
Function at 0x42b290
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x42b2a6
push str.download_toggle
call fcn.0043bb00
add esp, 4
mov edx, dword [0x4e3a48]
xor eax, eax
test edx, edx
sete al
mov dword [0x4e3a48], eax
test eax, eax
mov eax, dword [0x4e3a18]
je 0x42b2dc
test eax, eax
je 0x42b2e9
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4e3a14]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x42b2e9
test eax, eax
je 0x42b2e9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x4e3a48]
push ecx
push str.downloads
push str.show
call fcn.0044cf00
add esp, 0xc
ret

Function at 0x42b320
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x510ae0]
sub esp, 0x13c
test eax, eax
je 0x42b33c
push str.download_init
call fcn.0043bb00
add esp, 4
mov ecx, dword [0x4e3a24]
mov eax, dword [esp + 0x140]
test ecx, ecx
mov dword [0x4e3a14], eax
jne 0x42b365
push eax
call fcn.0042b420
add esp, 4
mov dword [0x4e3a24], 1
push 0x7f
call fcn.00433810
mov dword [0x4e3a4c], eax
mov eax, dword [0x4e3a3c]
add esp, 4
test eax, eax
jne 0x42b3c5
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x1f]
lea ecx, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x10], 0xfffffff5
call fcn.00430710
push eax
call fcn.00430690
add esp, 0x10
lea edx, [esp + 4]
mov dword [esp + 0x14], 0x2bc
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x4e3a3c], eax
pop edi
push str.downloads
push str.show
call fcn.0044cec0
add esp, 8
cmp eax, 0xffffffff
mov dword [0x4e3a48], eax
jne 0x42b3eb
mov dword [0x4e3a48], 0
call fcn.00410b10
push eax
lea eax, [esp + 0x40]
push str._scache_art
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.MSVCRT.dll__mkdir]
push 0x1e
call fcn.00469770
mov dword [0x4e3a44], eax
add esp, 0x150
ret
Function at 0x42ba20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x6c
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ecx
mov dword [esp + 4], eax
push eax
mov eax, dword [0x4e3a7c]
push eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
cmp eax, dword [0x4e3a78]
jne 0x42bb29
push ebp
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x2bc
mov ebp, eax
call fcn.004411b0
add esp, 4
push eax
push 0x3e8
push 0
push ebp
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [0x4e3a8c]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push edx
push 0
push eax
push ecx
push 0x102
push ebp
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp eax, 0x3e8
jne 0x42bb18
mov eax, dword [0x4e3a7c]
push ebx
push esi
push edi
lea edx, [esp + 0x18]
push 0x64
push edx
push 0x230
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov esi, eax
lea ecx, [esi + 1]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, esi
lea esi, [esp + 0x18]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov eax, dword [0x4e3a8c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
push ebp
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, 1
pop ebp
add esp, 0x6c
ret
mov eax, 1
add esp, 0x6c
ret

Function at 0x42bd60
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e3a88]
sub esp, 0x14
lea eax, [esp]
push ebx
push esi
push 0x13
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4e3a90]
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42bdab
test cl, cl
je 0x42bda7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42bdab
add eax, 2
add esi, 2
test cl, cl
jne 0x42bd83
xor eax, eax
jmp 0x42bdb0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42bdc5
lea eax, [esp + 8]
push eax
call fcn.004050c0
add esp, 4
mov esi, eax
jmp 0x42bdcb
mov esi, dword [0x4e3a84]
test esi, esi
jne 0x42bdf5
push 0x2bb
call fcn.004411b0
mov ecx, dword [0x4e3a80]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push fcn.0042bcd0
push 0x10
call fcn.0040d490
push esi
call fcn.0040ff60
add esp, 0xc
test eax, eax
je 0x42be22
push eax
call fcn.0042bcd0
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 0x14
ret
push 0x2b8
call fcn.004411b0
mov edx, dword [0x4e3a80]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x42be50
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e3a88]
sub esp, 0x14
lea eax, [esp]
push ebx
push esi
push edi
push 0x13
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4e3a90]
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x42be9c
test cl, cl
je 0x42be98
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x42be9c
add eax, 2
add esi, 2
test cl, cl
jne 0x42be74
xor eax, eax
jmp 0x42bea1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42beb6
lea eax, [esp + 0xc]
push eax
call fcn.004050c0
add esp, 4
mov edi, eax
jmp 0x42bebc
mov edi, dword [0x4e3a84]
test edi, edi
jne 0x42beec
lea ecx, [esp + 0xc]
push ecx
push 0xd3
call fcn.004411f0
mov edx, dword [0x4e3a80]
add esp, 8
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
mov eax, dword [0x4e3a7c]
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x227
push eax
call esi
cmp eax, 1
jne 0x42bf0b
mov esi, 0x12c
jmp 0x42bf46
mov ecx, dword [0x4e3a7c]
push 0x228
push ecx
call esi
cmp eax, 1
jne 0x42bf25
mov esi, 0xe10
jmp 0x42bf46
mov edx, dword [0x4e3a7c]
push 0x229
push edx
call esi
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0x7e900
add esi, 0x15180
push edi
push 0xf4
call fcn.0040d1b0
push esi
push 0xf5
call fcn.0040d1b0
add esp, 0x10
call fcn.0040d990
test eax, eax
je 0x42bf83
push eax
push 0xd2
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e3a80]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call fcn.0042b910
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x42cb60
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e3a94]
sub esp, 0x104
lea eax, [esp + 4]
mov edx, dword [ecx*4 + 0x4e3ac0]
push 0x100
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x4e3a94]
cmp eax, 1
jne 0x42cbd6
lea eax, [esp + 4]
push eax
call fcn.0046e7c0
add esp, 4
mov dword [esp], eax
test eax, eax
jne 0x42cbd0
push 0x2e9
call fcn.004411b0
mov ecx, dword [0x4e3a94]
add esp, 4
mov edx, dword [ecx*4 + 0x4e3ab8]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esp]
add esp, 0x104
ret
push eax
jmp 0x42cd30
mov eax, dword [eax*4 + 0x4e3a98]
push esi
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x556
push eax
call esi
test eax, eax
je 0x42cbf4
push 0
jmp 0x42cc13
mov ecx, dword [0x4e3a94]
push 0x557
mov edx, dword [ecx*4 + 0x4e3a98]
push edx
call esi
test eax, eax
je 0x42cc11
push 1
jmp 0x42cc13
push 2
push 0xf6
call fcn.0040d1b0
add esp, 8
mov dword [esp + 4], 0
push 0xf6
call fcn.0040d180
add esp, 4
sub eax, 0
pop esi
je 0x42cd03
dec eax
je 0x42cca3
dec eax
jne 0x42cd2b
mov al, byte [esp + 4]
lea ecx, [esp + 4]
test al, al
je 0x42cc65
cmp al, 0x30
jl 0x42cc79
cmp al, 0x39
jg 0x42cc79
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42cc55
lea edx, [esp]
lea eax, [esp + 4]
push edx
push 0x4c417c
push eax
jmp 0x42cd22
push 0x28b
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4e3a94]
mov ecx, dword [eax*4 + 0x4e3ab8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
add esp, 0x104
ret
mov al, byte [esp + 4]
lea ecx, [esp + 4]
test al, al
je 0x42ccc7
cmp al, 0x30
jl 0x42ccb7
cmp al, 0x39
jle 0x42ccbf
cmp al, 0x41
jl 0x42ccd8
cmp al, 0x46
jg 0x42ccd8
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x42ccaf
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push 0x4c7f5c
push ecx
jmp 0x42cd22
push 0x3a0
call fcn.004411b0
mov ecx, dword [0x4e3a94]
add esp, 4
mov edx, dword [ecx*4 + 0x4e3ab8]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
add esp, 0x104
ret
lea edx, [esp + 4]
push edx
call fcn.0046e7c0
add esp, 4
mov dword [esp], eax
test eax, eax
jne 0x42cd2b
push 0x2e9
jmp 0x42cc7e
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
mov edx, dword [esp]
push edx
push 0xf7
call fcn.0040d1b0
mov eax, dword [esp + 8]
add esp, 8
add esp, 0x104
ret
Function at 0x42ce30
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4e3a94]
sub esp, 0x100
mov dword [eax*4 + 0x4e3aa0], 0
call fcn.0042cb60
test eax, eax
je 0x42cf04
mov edx, dword [0x4e3a94]
lea ecx, [esp]
push 0x100
push ecx
mov eax, dword [edx*4 + 0x4e3ab0]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp]
push ecx
push 0xfa
call fcn.0040d240
mov edx, dword [0x4e3a94]
mov eax, dword [edx*4 + 0x4e3aa8]
push eax
push 0xf8
call fcn.0040d1b0
mov eax, dword [0x4e3a94]
add esp, 0x10
test eax, eax
jne 0x42ceab
call fcn.0040fa70
jmp 0x42ceb0
call fcn.0040f800
test eax, eax
je 0x42cee3
push eax
push 0x2ed
call fcn.004411f0
mov ecx, dword [0x4e3a94]
add esp, 8
mov edx, dword [ecx*4 + 0x4e3ab8]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x2f0
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4e3a94]
mov ecx, dword [eax*4 + 0x4e3ab8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret

Function at 0x42cf10
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4e3a94]
sub esp, 0x100
mov dword [eax*4 + 0x4e3aa0], 1
call fcn.0042cb60
test eax, eax
je 0x42cfe4
mov edx, dword [0x4e3a94]
lea ecx, [esp]
push 0x100
push ecx
mov eax, dword [edx*4 + 0x4e3ab0]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp]
push ecx
push 0xfa
call fcn.0040d240
mov edx, dword [0x4e3a94]
mov eax, dword [edx*4 + 0x4e3aa8]
push eax
push 0xf8
call fcn.0040d1b0
mov eax, dword [0x4e3a94]
add esp, 0x10
test eax, eax
jne 0x42cf8b
call fcn.0040fa70
jmp 0x42cf90
call fcn.0040f800
test eax, eax
je 0x42cfc3
push eax
push 0x2ee
call fcn.004411f0
mov ecx, dword [0x4e3a94]
add esp, 8
mov edx, dword [ecx*4 + 0x4e3ab8]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x2f1
call fcn.004411b0
add esp, 4
push eax
mov eax, dword [0x4e3a94]
mov ecx, dword [eax*4 + 0x4e3ab8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
Function at 0x42eab0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov edx, dword [0x4e4108]
test edx, edx
jne 0x42ead0
push 0x1f7
call fcn.00433810
mov edx, eax
add esp, 4
mov dword [0x4e4108], edx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
mov edi, ecx
push edi
push edx
call fcn.00433990
add esp, 0xc
test eax, eax
je 0x42eb13
mov eax, dword [0x510af0]
test eax, eax
je 0x42eb66
push esi
push str.file_exists___s_:_TRUE__from_hash_
call fcn.0043bb00
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, dword [0x510af0]
jne 0x42eb3c
test eax, eax
je 0x42eb36
push esi
push str.file_exists___s_:_FALSE
call fcn.0043bb00
add esp, 8
pop edi
xor eax, eax
pop esi
pop ecx
ret
test eax, eax
je 0x42eb4e
push esi
push str.file_exists___s_:_TRUE
call fcn.0043bb00
add esp, 8
mov ecx, dword [0x4e4108]
lea eax, [esp + 8]
push eax
push 0
push esi
push edi
push ecx
call fcn.00433750
add esp, 0x14
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x42ebe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [0x510af0]
push esi
mov esi, dword [esp + 8]
test eax, eax
je 0x42ebfc
push esi
push str.file_is_directory___s_
call fcn.0043bb00
add esp, 8
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
pop esi
je 0x42ec13
test al, 0x10
je 0x42ec13
mov eax, 1
ret
xor eax, eax
ret

Function at 0x42ec20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2000
call fcn.00488d40
mov eax, dword [0x510af0]
push ebx
mov ebx, dword [esp + 0x200c]
push esi
mov esi, dword [esp + 0x200c]
push edi
test eax, eax
je 0x42ec53
push ebx
push esi
push str.file_copy___s___s_
call fcn.0043bb00
add esp, 0xc
push 0x4c5ec0
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
call esi
mov edi, eax
add esp, 8
test edi, edi
jne 0x42ec79
pop edi
pop esi
mov eax, 0x19a
pop ebx
add esp, 0x2000
ret
push 0x4c5ec4
push ebx
call esi
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x42eca3
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 0x19a
pop edi
pop esi
pop ebx
add esp, 0x2000
ret
push ebp
push 0
push 0
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
add esp, 0xc
push edi
push 0x2000
lea eax, [esp + 0x18]
push 1
push eax
call ebp
mov esi, eax
push ebx
push esi
lea ecx, [esp + 0x28]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x20
cmp esi, 0x2000
je 0x42ecb8
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
push edi
call esi
push ebx
call esi
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2000
ret
Function at 0x42ef70
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x510af0]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
test eax, eax
je 0x42ef8f
push esi
push str.file_read___s_
call fcn.0043bb00
add esp, 8
mov ebx, dword [esp + 0x18]
push 0x8000
push esi
mov dword [ebx], 0
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x42efb9
pop edi
pop esi
pop ebp
mov eax, 0x19a
pop ebx
ret
mov ebp, dword [sym.imp.MSVCRT.dll__lseek]
push 2
push 0
push esi
call ebp
mov edi, eax
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0x10
mov dword [ebx], eax
test eax, eax
je 0x42effe
push 0
push 0
push esi
call ebp
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x42efec
mov dword [eax], edi
mov eax, dword [ebx]
push edi
push eax
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
cmp eax, edi
je 0x42f022
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov ebx, dword [ebx]
add esp, 4
test ebx, ebx
je 0x42f018
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x190
pop ebx
ret
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42f1d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x308
push ebx
mov ebx, dword [esp + 0x310]
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], 0
je 0x42f37f
mov ebp, dword [esp + 0x320]
test ebp, ebp
je 0x42f37f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
je 0x42f37f
push ebp
mov byte [eax], 0
call fcn.0042f390
push ebp
call fcn.0042ebe0
add esp, 8
test eax, eax
je 0x42f37f
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.0042f170
mov edi, eax
add esp, 8
test edi, edi
je 0x42f370
mov ebx, dword [esp + 0x324]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42f370
mov esi, 0x4c7950
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42f2b1
test cl, cl
je 0x42f2ad
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42f2b1
add eax, 2
add esi, 2
test cl, cl
jne 0x42f28d
xor eax, eax
jmp 0x42f2b6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42f359
mov esi, 0x4c794c
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42f2e9
test cl, cl
je 0x42f2e5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42f2e9
add eax, 2
add esi, 2
test cl, cl
jne 0x42f2c5
xor eax, eax
jmp 0x42f2ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42f359
lea eax, [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x220]
push 0x4c5924
push ecx
call ebp
mov edx, dword [esp + 0x330]
push edi
push edx
lea eax, [esp + 0x130]
push 0x4c5924
push eax
call ebp
add esp, 0x20
test ebx, ebx
jne 0x42f339
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42f355
lea edx, [esp + 0x118]
lea eax, [esp + 0x218]
push edx
push eax
call fcn.0042ec20
add esp, 8
test eax, eax
jne 0x42f359
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042f1a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x42f27a
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x308
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x308
ret
Function at 0x42f390
Capabilities:
Create directory

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
test esi, esi
push edi
jne 0x42f3ae
pop edi
xor eax, eax
pop esi
add esp, 0x100
ret
push esi
call fcn.0042ebe0
add esp, 4
test eax, eax
je 0x42f3c9
pop edi
mov eax, 1
pop esi
add esp, 0x100
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x100
jb 0x42f3e6
pop edi
pop esi
add esp, 0x100
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebx, dword [sym.imp.MSVCRT.dll_strchr]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
push 0x5c
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x42f433
lea edx, [esp + 0x10]
push 0x2f
push edx
call ebx
mov esi, eax
add esp, 8
test esi, esi
mov ebp, dword [sym.imp.MSVCRT.dll__mkdir]
je 0x42f479
test esi, esi
je 0x42f479
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call ebp
lea edi, [esi + 1]
add esp, 4
test edi, edi
mov byte [esi], 0x5c
je 0x42f479
cmp byte [edi], 0
je 0x42f479
push 0x5c
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x42f43f
push 0x2f
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x42f479
jne 0x42f43b
mov ecx, dword [esp + 0x114]
push ecx
call ebp
add esp, 4
mov eax, 1
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x100
ret
Function at 0x42f4a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [esp + 0x224]
push edi
push ebp
call fcn.0042ebe0
add esp, 4
test eax, eax
jne 0x42f4c7
pop edi
pop ebp
pop ebx
add esp, 0x218
ret
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push ebp
lea eax, [esp + 0x128]
push str._s.
push eax
call ebx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x130]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__findfirst]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x42f503
pop edi
pop ebp
pop ebx
add esp, 0x218
ret
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.MSVCRT.dll__findnext]
add esp, 8
test eax, eax
jne 0x42f5de
push esi
mov esi, 0x4c7950
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42f548
test cl, cl
je 0x42f544
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42f548
add eax, 2
add esi, 2
test cl, cl
jne 0x42f524
xor eax, eax
jmp 0x42f54d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42f5c6
mov esi, 0x4c794c
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x42f57e
test cl, cl
je 0x42f57a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x42f57e
add eax, 2
add esi, 2
test cl, cl
jne 0x42f55a
xor eax, eax
jmp 0x42f583
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42f5c6
lea eax, [esp + 0x24]
lea ecx, [esp + 0x128]
push eax
push ebp
push 0x4c5924
push ecx
call ebx
mov al, byte [esp + 0x20]
add esp, 0x10
test al, 0x10
je 0x42f5b6
lea edx, [esp + 0x128]
push edx
call fcn.0042f4a0
jmp 0x42f5c3
lea eax, [esp + 0x128]
push eax
call fcn.0042eb70
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.MSVCRT.dll__findnext]
add esp, 8
test eax, eax
je 0x42f51b
pop esi
push edi
call dword [sym.imp.MSVCRT.dll__findclose]
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x218
ret