joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46639c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x466464
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407aec
xor eax, eax
push ebp
push 0x46643e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x466434
add ebx, 2
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466370]
call fcn.00409f44
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x46641c
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004089d8
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466370]
call fcn.00409f44
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x466448
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46646b
lea eax, [ebp - 4]
mov edx, dword [0x466370]
call fcn.0040a068
ret

Function at 0x466474
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407bd0
xor eax, eax
push ebp
push 0x4665d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00407aec
mov edx, dword [ebp - 4]
mov eax, 0x4665f0
call fcn.00408ef8
test eax, eax
jne 0x466543
lea eax, [ebp - 8]
mov edx, 1
call fcn.00408b04
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408980
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00408b04
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x466537
mov eax, dword [ebp - 8]
call fcn.00408980
call fcn.00408008
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00408b04
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00407ecc
jmp 0x4665b8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407ecc
jmp 0x4665b8
lea eax, [ebp - 8]
mov edx, 1
call fcn.00408b04
push 0
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
mov eax, dword [ebp - 4]
call fcn.00408980
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00408b04
push ebx
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x4665ae
mov eax, dword [ebp - 8]
call fcn.00408980
call fcn.00408008
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00408b04
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00407ecc
jmp 0x4665b8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4665da
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret
Function at 0x46a288
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x46a324
push 0
mov eax, ebx
call fcn.00408980
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x46a2ff
mov ebx, esi
test ebx, ebx
je 0x46a2d1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408980
push eax
push 1
push 0
mov eax, edi
call fcn.00408980
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x46a31a
mov ecx, dword [0x50a8c0]
mov dl, 1
mov eax, dword [0x4687d0]
call fcn.00423cd4
call fcn.004071e4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x46b2f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b3c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407aec
xor edx, edx
push ebp
push 0x46b3a4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x46b39a
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004089d8
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46b36a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46b380
mov eax, ebx
mov edx, 0x46b3e4
call fcn.00408b84
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046b2a8
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b3ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b3ce
lea eax, [ebp - 0x208]
call fcn.00407aec
ret
Function at 0x46b3e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b4b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407aec
xor edx, edx
push ebp
push 0x46b494
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x46b48a
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004089d8
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46b45a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46b470
mov eax, ebx
mov edx, 0x46b4d4
call fcn.00408b84
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046b2a8
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b49e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b4be
lea eax, [ebp - 0x208]
call fcn.00407aec
ret

Function at 0x46b4d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b5de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407aec
xor edx, edx
push ebp
push 0x46b5b0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x50a790]
cmp byte [eax], 0
jne 0x46b535
mov eax, ebx
call fcn.0046b3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b5ba
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x46b5a6
mov eax, ebx
lea edx, [ebp - 0x20a]
call fcn.004089d8
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0046b2a8
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00407ecc
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x46b588
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46b5a6
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.00424d38
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00407ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b5ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b5e5
lea eax, [ebp - 0x218]
call fcn.00407aec
lea eax, [ebp - 0x210]
call fcn.00407aec
ret
Function at 0x46b6ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b7e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407aec
xor edx, edx
push ebp
push 0x46b7b8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x46b7ae
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004089d8
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0046ff34
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00407ecc
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046b2a8
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407ecc
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x46b798
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46b7ae
mov eax, ebx
mov edx, 0x46b7fc
call fcn.00408b84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b7c2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b7e7
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407b4c
ret

Function at 0x46b800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46b8d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407aec
xor edx, edx
push ebp
push 0x46b8b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x46b8a6
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.0041f408
lea edx, [ebp - 0x408]
mov eax, dword [ebx]
call fcn.0046b2a8
mov edx, dword [ebp - 0x408]
mov eax, ebx
call fcn.00407ecc
cmp dword [ebx], 0
je 0x46b8a6
lea edx, [ebp - 0x40c]
mov eax, dword [ebx]
call fcn.00424d38
mov edx, dword [ebp - 0x40c]
mov eax, ebx
call fcn.00407ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b8ba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b8df
lea eax, [ebp - 0x40c]
mov edx, 2
call fcn.00407b4c
ret
Function at 0x46c280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c3fb
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46c3d3
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045ef28
cmp al, 0xa
jb 0x46c363
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408b04
xor edx, edx
push ebp
push 0x46c35c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46c344
mov eax, dword [ebp - 4]
call fcn.00408980
mov edx, dword [ebp - 8]
call fcn.0041f408
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c316
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c332
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00424d38
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407ecc
call fcn.004072d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c3dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c363
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408b04
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x50a8b4]
mov eax, dword [eax]
mov ecx, 0x46c418
mov edx, 0x46c444
call fcn.0046195c
test al, al
je 0x46c3c9
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c397
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c3c9
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c3ac
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c3c9
mov eax, dword [ebp - 8]
mov edx, 0x46c4d4
call fcn.00408b84
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c3dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c402
lea eax, [ebp - 0x10]
call fcn.00407aec
lea eax, [ebp - 4]
call fcn.00407aec
ret
Function at 0x46c4d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c66c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46c63f
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045ef28
cmp al, 0xa
jb 0x46c5b7
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408b04
xor edx, edx
push ebp
push 0x46c5b0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46c598
mov eax, dword [ebp - 4]
call fcn.00408980
mov edx, dword [ebp - 8]
call fcn.0041f408
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c56a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c586
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00424d38
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407ecc
call fcn.004072d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c649
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c5b7
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408b04
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x50a96c]
mov eax, dword [eax]
mov ecx, 0x46c688
mov edx, 0x46c6a4
call fcn.0046195c
test al, al
je 0x46c635
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0046b2a8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c603
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c635
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c618
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c635
mov eax, dword [ebp - 8]
mov edx, 0x46c734
call fcn.00408b84
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c649
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c673
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407b4c
lea eax, [ebp - 4]
call fcn.00407aec
ret
Function at 0x46c738
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c8cc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46c89f
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045ef28
cmp al, 0xa
jb 0x46c817
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408b04
xor edx, edx
push ebp
push 0x46c810
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46c7f8
mov eax, dword [ebp - 4]
call fcn.00408980
mov edx, dword [ebp - 8]
call fcn.0041f408
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c7ca
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c7e6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00424d38
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407ecc
call fcn.004072d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c8a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c817
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408b04
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x50a96c]
mov eax, dword [eax]
mov ecx, 0x46c8e8
mov edx, 0x46c910
call fcn.0046195c
test al, al
je 0x46c895
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0046b2a8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c863
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c895
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46c878
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c895
mov eax, dword [ebp - 8]
mov edx, 0x46c9a0
call fcn.00408b84
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c8a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c8d3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407b4c
lea eax, [ebp - 4]
call fcn.00407aec
ret
Function at 0x46f3bc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x46f555
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x46f3fc
call fcn.0045f990
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x46f407
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46f412
xor ebx, ebx
jmp 0x46f52d
cmp byte [ebp - 0x12], 0
je 0x46f516
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00407f14
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00424d88
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00407f14
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041ec70
mov eax, dword [ebp - 8]
test eax, eax
je 0x46f453
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x46f480
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408d4c
mov eax, dword [ebp - 0x1c]
mov edx, 0x46f570
call fcn.00408d14
sete al
jmp 0x46f482
xor eax, eax
test al, al
je 0x46f48a
mov al, 1
jmp 0x46f494
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041e57c
test al, al
je 0x46f49c
mov al, 1
jmp 0x46f4aa
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408d14
sete al
test al, al
jne 0x46f52d
cmp dword [ebp - 4], 0
jne 0x46f4ce
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
call sub.kernel32.dll_CreateDirectoryW_1
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46f52d
mov eax, dword [ebp - 4]
call fcn.00408980
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.004089d8
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0046f3bc
mov ebx, eax
test bl, bl
je 0x46f50c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
call sub.kernel32.dll_CreateDirectoryW_1
test eax, eax
jne 0x46f510
xor eax, eax
jmp 0x46f512
mov al, 1
mov ebx, eax
jmp 0x46f52d
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_CreateDirectoryW_1
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f55c
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407b4c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407b4c
ret

Function at 0x46f574
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46f58d
test al, 0x10
jne 0x46f591
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x46fe3c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0046feec
test al, al
je 0x46fe7c
mov eax, esi
call fcn.0041ea60
mov ebx, eax
test bl, bl
jne 0x46fe7c
mov eax, esi
call fcn.0046fd20
push 0x80
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041ea60
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46fe84
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0046feec
test al, al
je 0x46fee4
mov eax, esi
call fcn.0041ea60
mov ebx, eax
test bl, bl
jne 0x46fee4
mov eax, esi
call fcn.0046fd20
push 0x80
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041ea60
mov ebx, eax
test bl, bl
jne 0x46fee4
cmp byte [esp], 0
je 0x46fee4
call fcn.0045ef44
test al, al
je 0x46fee4
mov eax, esi
call fcn.00470460
mov ebx, eax
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x46feec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46ff05
test al, 0x10
je 0x46ff09
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x46ff10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46ff29
test al, 0x10
je 0x46ff2d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x470074
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4700dd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407f14
lea eax, [ebp - 8]
mov edx, esi
call fcn.00407f14
mov eax, dword [ebp - 8]
call fcn.00408980
push eax
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4700e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret