joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x421fb0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x49ee80]
test eax, eax
je 0x422120
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x421f9c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x421f9c
test byte [eax + 0x20], 0x30
je 0x422070
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x422110
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x422020
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x422012
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x422176
mov eax, dword [0x49ee80]
test eax, eax
je 0x422150
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x4220d0
test eax, eax
je 0x42208a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x422100
test byte [ebx + 0x24], 4
je 0x4220e7
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x422019
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x422019
test eax, eax
je 0x4220e0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x421f9c
call sym.__pthread_cleanup_dest.part.3
jmp 0x4220a2
call sym.__pthread_cleanup_dest.part.3
jmp 0x421fee
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49ee80], eax
jmp 0x421fbd
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49ee80], eax
jmp 0x42204d
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x422040
Function at 0x423310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42338b
test byte [ebx + 0x20], 0x30
je 0x423392
mov eax, dword [0x49ee80]
test eax, eax
je 0x42341b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x423382
cmp dword [eax + 0x14], 0
je 0x4233a5
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x423375
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4233ef
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x42332d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4233bc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x423412
mov eax, dword [0x49ee80]
test eax, eax
je 0x423441
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x423382
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x4233cf
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4233cf
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49ee80], eax
jmp 0x423340
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49ee80], eax
jmp 0x4233d8
Function at 0x426ab0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.00414760
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x426b9f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x426c43
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x426bd8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x426bd0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x426c40
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x426c5a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x426c12
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x426c12
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x426c12
Function at 0x4874c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
lea eax, [esp + 0x60]
mov dword [esp + 0x34], sym.___gxx_personality_sj0
mov dword [esp + 0x38], 0x48b064
mov dword [esp + 0x40], 0x4875c5
mov dword [esp + 0x44], esp
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], eax
call dbg._Unwind_SjLj_Register
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x5f]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call sym.std::istream::sentry::sentry_std::istream__bool_
sub esp, 8
cmp byte [esp + 0x5f], 0
jne 0x487543
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x80]
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x80]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebx + eax + 0x78]
mov edx, dword [ecx + 8]
cmp edx, dword [ecx + 0xc]
jae 0x487580
movzx eax, byte [edx]
add edx, 1
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x84]
mov byte [edx], al
jmp 0x487528
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x20], 1
call eax
cmp eax, 0xffffffff
jne 0x48756b
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
mov eax, dword [eax]
add ecx, dword [eax - 0xc]
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x20], 0xffffffff
or eax, 6
mov dword [esp], eax
call method.std::basic_ios_char__std::char_traits_char___.clear_std::_Ios_Iostate_
sub esp, 4
jmp 0x487528
Function at 0x416460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489bae
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4af204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], 0
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], 0
cmp byte [eax + 8], 0
jne 0x416557
push 0x23
xor eax, eax
mov dword [ebp - 0x2c], 7
push str.Use_exit_menu_item_to_shut_it_down.
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.0040b6b0
push 0x1d
xor eax, eax
mov byte [ebp - 4], 2
push str.Application_is_still_running.
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.0040b6b0
mov ecx, dword [esi + 0x2c]
lea eax, [ebp - 0x40]
push 1
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0041b470
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41651c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040be10
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
cmp eax, 8
jb 0x416545
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0040be10
mov eax, dword [esi + 0x30]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
jmp 0x416563
cmp dword [esi + 0x24], 1
jne 0x416561
mov byte [esi + 0x28], 1
xor bl, bl
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x416581
mov edx, dword [ecx + 4]
add ecx, 4
mov edx, dword [edx + 4]
add ecx, edx
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457807
mov esp, ebp
pop ebp
ret 4

Function at 0x416bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489d5c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4af204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
call fcn.004092d0
cmp dword [eax + 0x14], 8
jb 0x416c03
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x416c2c
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040be10
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
test eax, eax
je 0x416c47
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 3
test eax, eax
je 0x416c65
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457807
mov esp, ebp
pop ebp
ret 0x30
Function at 0x416df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489df2
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4af204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 2
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x416ebf
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.004092d0
cmp dword [eax + 0x14], 8
jb 0x416e5b
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x416e84
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040be10
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x34], vtable.CefStringBase_struct_CefStringTraitsUTF16_.0
test eax, eax
je 0x416ebf
cmp byte [ebp - 0x2c], 0
je 0x416ebf
push eax
call sub.libcef.dll_cef_string_utf16_clear
push 0xc
push dword [ebp - 0x30]
call fcn.0045732e
add esp, 0xc
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 4
test eax, eax
je 0x416eda
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 5
test eax, eax
je 0x416ef5
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 6
test eax, eax
je 0x416f13
mov ecx, dword [eax + 4]
add eax, 4
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457807
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41bc40
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
push 5
mov dword [esp + 0x10], ebx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
mov ebx, eax
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [eax + 4]
call esi
mov eax, dword [esp + 0xc]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [eax + 4]
call esi
mov esi, dword [esp + 0xc]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x45ab70
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dd98
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4af204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x68]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
push ebx
push eax
mov dword [ebp - 0x60], esi
call fcn.0045d3a0
add esp, 0xc
test edi, edi
je 0x45abc2
cmp dword [edi], 0
jne 0x45acb4
mov eax, dword [ebp - 0x68]
cmp eax, 4
jne 0x45abda
push edi
push esi
push ebx
call fcn.0045ad90
add esp, 0xc
jmp 0x45acb4
cmp eax, 3
jne 0x45abef
push edi
push esi
push ebx
call fcn.0045acd0
add esp, 0xc
jmp 0x45acb4
cmp eax, 2
jne 0x45ac37
cmp dword [esi + 0x14], 8
jb 0x45abfe
mov eax, dword [esi]
jmp 0x45ac00
mov eax, esi
cmp dword [ebx + 0x14], 8
jb 0x45ac0a
mov ecx, dword [ebx]
jmp 0x45ac0c
mov ecx, ebx
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x45ac22
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45ac24
xor eax, eax
push str.boost::filesystem::copy_file
push edi
push esi
push ebx
push eax
call fcn.0045be20
add esp, 0x14
jmp 0x45acb4
test edi, edi
jne 0x45ac96
push str.boost::filesystem::copy
lea ecx, [ebp - 0x28]
call fcn.004042b0
mov dword [ebp - 4], edi
call fcn.0045d460
mov esi, eax
mov dword [ebp - 0x6c], 0x32
push 0x32
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
sub esp, 0xc
mov byte [ebp - 0x68], al
movq xmm0, qword [ebp - 0x6c]
lea ecx, [ebp - 0x5c]
mov eax, esp
push dword [ebp - 0x60]
movq qword [eax], xmm0
mov dword [eax + 8], esi
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.0045a380
push 0x4acd3c
lea eax, [ebp - 0x5c]
push eax
call fcn.0046016b
call fcn.0045d460
mov esi, eax
mov dword [edi], 0x32
push 0x32
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
mov byte [edi + 4], al
mov dword [edi + 8], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457807
mov esp, ebp
pop ebp
ret

Function at 0x45acd0
Capabilities:
Create directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x45ace0
mov eax, dword [esi]
jmp 0x45ace2
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x45acf0
mov ecx, dword [edi]
jmp 0x45acf2
mov ecx, edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x45ad08
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45ad0a
xor eax, eax
push str.boost::filesystem::copy_directory
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.0045be20
add esp, 0x14
pop edi
pop esi
ret
Function at 0x45ad30
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x45ad40
mov ecx, dword [esi]
jmp 0x45ad42
mov ecx, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x45ad50
mov edx, dword [edi]
jmp 0x45ad52
mov edx, edi
xor eax, eax
cmp dword [esp + 0x14], eax
sete al
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x45ad70
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45ad72
xor eax, eax
push str.boost::filesystem::copy_file
push dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.0045be20
add esp, 0x14
pop edi
pop esi
ret

Function at 0x45b100
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48dbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4af204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 8
jb 0x45b13b
mov eax, dword [ebx]
jmp 0x45b13d
mov eax, ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x45b167
test edi, edi
je 0x45b160
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0045d460
mov dword [edi + 8], eax
mov al, 1
jmp 0x45b233
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
call fcn.0045d460
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.0045d160
add esp, 0xc
cmp dword [ebp - 0x74], 3
sete al
test al, al
je 0x45b1bb
test edi, edi
je 0x45b231
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0045d460
mov dword [edi + 8], eax
jmp 0x45b231
test edi, edi
jne 0x45b215
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.004042b0
mov dword [ebp - 4], edi
call fcn.0045d460
mov esi, eax
mov eax, dword [ebp - 0x60]
push eax
mov ecx, esi
mov dword [ebp - 0x6c], eax
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
sub esp, 0xc
mov byte [ebp - 0x68], al
movq xmm0, qword [ebp - 0x6c]
lea ecx, [ebp - 0x5c]
mov eax, esp
push ebx
movq qword [eax], xmm0
mov dword [eax + 8], esi
lea eax, [ebp - 0x28]
push eax
call fcn.0045a470
push 0x4acd3c
lea eax, [ebp - 0x5c]
push eax
call fcn.0046016b
call fcn.0045d460
mov esi, eax
mov eax, dword [ebp - 0x60]
mov dword [edi], eax
mov ecx, esi
push eax
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
mov byte [edi + 4], al
mov dword [edi + 8], esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00457807
mov esp, ebp
pop ebp
ret
Function at 0x45c970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x45c983
mov eax, dword [esi]
jmp 0x45c985
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45c9ad
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0045c810
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x45c9c8
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0045d460
mov dword [edi + 8], eax
pop edi
test ebx, 0x400
je 0x45c9ff
push esi
call fcn.0045c2a0
add esp, 4
test al, al
je 0x45c9f4
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x45cf60
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x45cf6c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x45cfaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x45cfaa
cmp eax, 3
je 0x45cfaa
cmp eax, 0x7b
je 0x45cfaa
cmp eax, 0xf
je 0x45cfaa
cmp eax, 0x15
je 0x45cfaa
cmp eax, 0x57
je 0x45cfaa
cmp eax, 0xa1
je 0x45cfaa
cmp eax, 0x35
je 0x45cfaa
xor al, al
ret
mov al, 1
ret

Function at 0x45cfb0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x45cfbc
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x45cffa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x45cffa
cmp eax, 3
je 0x45cffa
cmp eax, 0x7b
je 0x45cffa
cmp eax, 0xf
je 0x45cffa
cmp eax, 0x15
je 0x45cffa
cmp eax, 0x57
je 0x45cffa
cmp eax, 0xa1
je 0x45cffa
cmp eax, 0x35
je 0x45cffa
xor al, al
ret
mov al, 1
ret

Function at 0x45d0a0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x45d0b0
mov eax, dword [esi]
jmp 0x45d0b2
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x45d0c0
mov ecx, dword [edi]
jmp 0x45d0c2
mov ecx, edi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x45d0d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x45d0da
xor eax, eax
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.0045be20
add esp, 0x14
pop edi
pop esi
ret