joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01806e52
and dword [ebp - 0x14], 0
cmp dword [0x185d558], 0
mov dword [ebp - 0x18], eax
jne 0x180fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x180fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x180fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x185d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x185d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x185d560], eax
call edi
push eax
call esi
mov dword [0x185d568], eax
test eax, eax
je 0x180fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x185d564], eax
mov eax, dword [0x185d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x180fc78
cmp dword [0x185d568], ecx
je 0x180fc78
push eax
call esi
push dword [0x185d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x180fc78
test ebx, ebx
je 0x180fc78
call edi
test eax, eax
je 0x180fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x180fc6f
test byte [ebp - 8], 1
jne 0x180fc78
or dword [ebp + 0x10], 0x200000
jmp 0x180fcab
mov eax, dword [0x185d55c]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x180fcab
mov eax, dword [0x185d560]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x185d558]
call esi
test eax, eax
je 0x180fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x180fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.018013cb
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40201d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x24], 0
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x20], ebp
je 0x40203b
mov eax, dword [ebp]
push dword [esp + 0x34]
call dword [eax + 8]
xorps xmm0, xmm0
xor esi, esi
cmp dword [esp + 0x30], 8
movlpd qword [esp + 0x18], xmm0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x34], esi
jb 0x4020e5
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
push 8
pop ecx
sub ecx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edx]
xor edi, dword [edx + 4]
xor ecx, ebx
xor ebx, ebx
mov dword [esp + 0x14], eax
mov edx, dword [eax + 4]
inc ebx
add edi, dword [eax]
add edx, ecx
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
cmp eax, ebx
jl 0x4020be
mov ebp, dword [esp + 0x14]
mov esi, eax
xor edi, edx
mov ecx, edx
and ecx, 0x1f
rol edi, cl
add edi, dword [ebp + ebx*8]
xor edx, edi
mov ecx, edi
and ecx, 0x1f
rol edx, cl
add edx, dword [ebp + ebx*8 + 4]
inc ebx
cmp ebx, esi
jle 0x402097
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
xor ebx, ebx
or ebx, edx
add esi, 8
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], esi
mov dword [edx], ebx
mov dword [edx + 4], edi
add edx, 8
add eax, edx
mov dword [esp + 0x10], edx
cmp eax, dword [esp + 0x30]
jbe 0x40206e
cmp esi, dword [esp + 0x30]
jae 0x40218a
mov edi, dword [esp + 0x2c]
mov al, byte [esi + edi]
xor al, bl
mov dword [esp + 0x24], 1
mov byte [esi + edi], al
mov bl, al
mov ecx, dword [ebp + 0x1c]
shr bl, 4
mov ah, byte [ecx + 4]
add bl, byte [ecx]
add ah, al
and bl, 0xf
and ah, 0xf
cmp dword [ebp + 0x18], 1
jl 0x402173
mov esi, dword [esp + 0x24]
mov edi, ecx
mov dl, ah
mov al, ah
xor dl, bl
and al, 3
mov bl, dl
mov cl, 4
sub cl, al
shr bl, cl
movzx ecx, ah
and ecx, 3
shl dl, cl
mov cl, 4
or bl, dl
mov dl, ah
add bl, byte [edi + esi*8]
and bl, 0xf
xor dl, bl
mov al, bl
and al, 3
mov ah, dl
sub cl, al
shr ah, cl
movzx ecx, bl
and ecx, 3
shl dl, cl
or ah, dl
add ah, byte [edi + esi*8 + 4]
and ah, 0xf
inc esi
cmp esi, dword [ebp + 0x18]
jle 0x402124
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
shl bl, 4
add bl, ah
mov byte [esi + edi], bl
inc esi
mov dword [esp + 0x34], esi
cmp esi, dword [esp + 0x30]
jb 0x4020f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x402194
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x24], 0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
je 0x4021b1
mov eax, dword [esi]
push dword [esp + 0x34]
call dword [eax + 8]
mov ebp, dword [esp + 0x2c]
xorps xmm0, xmm0
xor edi, edi
movlpd qword [esp + 0x20], xmm0
cmp dword [esp + 0x30], 8
jb 0x40225f
push 8
pop eax
sub eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x18]
mov edx, dword [ebp]
mov ebx, dword [ebp + 4]
test eax, eax
jle 0x40221c
mov ecx, dword [esi + 0x1c]
mov esi, ecx
mov dword [esp + 0x18], ecx
sub edx, dword [esi + eax*8 + 4]
mov ecx, ebx
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [esi + eax*8]
mov ecx, edx
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
dec eax
test eax, eax
jg 0x4021fa
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x1c]
xor ecx, ecx
add edi, 8
sub ebx, dword [eax]
sub edx, dword [eax + 4]
or ecx, ebx
mov eax, dword [ebp]
xor edx, dword [esp + 0x34]
xor ecx, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add ebp, 8
add eax, ebp
cmp eax, dword [esp + 0x30]
jbe 0x4021e4
mov ebp, dword [esp + 0x2c]
jmp 0x4022fb
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
jmp 0x4022fb
mov bl, byte [edi + ebp]
mov eax, dword [esi + 0x18]
mov dh, bl
shr dh, 4
mov cl, bl
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x4022df
mov eax, dword [esi + 0x1c]
mov esi, eax
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
sub bl, byte [esi + ebp*8 + 4]
movzx eax, dh
and bl, 0xf
and eax, 3
mov dl, bl
push 4
pop ecx
sub ecx, eax
shl bl, cl
mov cl, dh
and cl, 3
shr dl, cl
or bl, dl
xor bl, dh
sub dh, byte [esi + ebp*8]
and dh, 0xf
movzx eax, bl
and eax, 3
mov dl, dh
push 4
pop ecx
sub ecx, eax
shl dh, cl
mov cl, bl
and cl, 3
shr dl, cl
or dh, dl
xor dh, bl
dec ebp
test ebp, ebp
jg 0x40228e
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x14]
mov cl, byte [edi + ebp]
mov eax, dword [esi + 0x1c]
sub bl, byte [eax + 4]
sub dh, byte [eax]
and bl, 0xf
shl dh, 4
add bl, dh
xor bl, byte [esp + 0x34]
mov byte [edi + ebp], bl
inc edi
mov byte [esp + 0x34], cl
cmp edi, dword [esp + 0x30]
jb 0x40226c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x40251f
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x1c
movsd xmm0, qword [0x43c210]
push ebx
push ebp
push esi
push edi
push ecx
push ecx
mov edi, ecx
movsd qword [esp], xmm0
call fcn.0041c2d0
pop ecx
fstp qword [esp + 0x28]
movsd xmm0, qword [esp + 0x28]
pop ecx
call fcn.0042bf31
mov esi, eax
mov dword [esp + 0x20], eax
shl esi, 2
push esi
call fcn.0041c159
push esi
mov ebp, eax
xor ebx, ebx
push ebx
push ebp
mov dword [esp + 0x2c], ebp
call fcn.00417170
push 0x10
lea ecx, [edi + 8]
push ecx
push ebp
call fcn.004172d0
mov eax, dword [edi + 0x18]
add esp, 0x1c
lea esi, [eax*2 + 2]
cmp dword [edi + 0x1c], ebx
je 0x402593
push dword [edi + 0x1c]
call fcn.0041c139
pop ecx
mov eax, esi
shl eax, 2
push eax
call fcn.0041c159
mov dword [edi + 0x1c], eax
pop ecx
test eax, eax
je 0x402645
xor edx, edx
mov dword [eax], 0xb7e15163
inc edx
cmp esi, edx
jbe 0x4025cb
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx + edx*4 - 4]
sub eax, 0x61c88647
mov dword [ecx + edx*4], eax
inc edx
cmp edx, esi
jb 0x4025b7
imul eax, esi, 3
mov edx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x40263b
mov ecx, dword [edi + 0x1c]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
mov eax, dword [ecx + eax*4]
add eax, edx
add eax, dword [esp + 0x14]
rol eax, 3
mov dword [ecx + ebp*4], eax
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
lea ecx, [edx + eax]
add edx, eax
mov eax, dword [esp + 0x10]
and ecx, 0x1f
add edx, dword [ebp + ebx*4]
rol edx, cl
inc eax
mov dword [ebp + ebx*4], edx
mov dword [esp + 0x24], edx
xor edx, edx
div esi
lea eax, [ebx + 1]
mov dword [esp + 0x10], edx
xor edx, edx
div dword [esp + 0x20]
sub dword [esp + 0x18], 1
mov ebx, edx
mov edx, dword [esp + 0x24]
jne 0x4025e0
push ebp
call fcn.0041c139
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4029d7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0xc]
mov eax, dword [ecx + 0x20c]
test eax, eax
cmovne ecx, eax
call fcn.00404bbc
test eax, eax
jne 0x402b1f
push 0x43aecc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x402b1f
push str.NtQueryInformationFile
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402b1f
push 0x20e
xor ebx, ebx
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.00417170
add esp, 0xc
lea eax, [ebp - 0x258]
push 9
push 0x20c
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x21c]
call esi
test eax, eax
js 0x402b1f
mov eax, dword [ebp - 0x258]
xor ecx, ecx
shr eax, 1
mov word [ebp + eax*2 - 0x254], cx
lea eax, [ebp - 0x48]
push eax
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x402b1f
push 0x410
lea eax, [ebp - 0x668]
push ebx
push eax
call fcn.00417170
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
push 0x207
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [0x43aef8]
lea esi, [ebp - 0x668]
mov dword [ebp - 0xc], eax
mov eax, dword [0x43aefc]
mov dword [ebp - 8], eax
movzx eax, word [ebp - 0x668]
mov word [ebp - 0xc], ax
cmp ax, 0x41
je 0x402b0c
cmp ax, 0x42
je 0x402b0c
lea ecx, [ebp - 0xc]
call fcn.004048fd
cmp eax, 3
jne 0x402b0c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x2c]
je 0x402b28
movzx eax, word [esi]
add esi, 2
test ax, ax
jne 0x402b0c
movzx eax, word [esi]
test ax, ax
jne 0x402ad0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push 2
push eax
push esi
call fcn.0041a019
push 0x102
lea eax, [ebp - 0x254]
push eax
lea eax, [esi + 4]
push eax
call fcn.0041a019
xor eax, eax
add esp, 0x18
inc eax
jmp 0x402b21
Function at 0x402c57
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 8]
call fcn.00408c37
cmp dword [esp + 0x10], 0
jne 0x402c7f
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402c77
and dword [ecx], 0
xor eax, eax
inc eax
jmp 0x402d47
push ebx
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 8]
add dword [edi + 0x220], eax
adc dword [edi + 0x224], 0
test ecx, ecx
je 0x402cb8
mov dword [ecx], eax
test ebx, ebx
jne 0x402d44
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 8]
mov esi, eax
push 3
call fcn.00408c37
mov ecx, dword [edi + 8]
mov ebp, 0x43ae70
push 1
push ebp
call fcn.00408b10
push ecx
mov ecx, dword [edi + 8]
push esi
call fcn.0040912f
push dword [edi + 0x21c]
push str._IXStream__Handle__p_
push dword [edi + 8]
call fcn.00408dff
push dword [edi + 0x230]
push str._IXStream__Access__x_
push dword [edi + 8]
call fcn.00408dff
add esp, 0x18
mov ecx, edi
call fcn.004028e7
push eax
push 0x6d68
push ebp
push dword [edi + 8]
call fcn.00408c70
add esp, 0x10
mov ecx, edi
call fcn.004028e7
mov ecx, dword [edi + 8]
push eax
push 1
call fcn.00408e88
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
pop ecx
ret 0xc
Function at 0x402d4c
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
mov ecx, dword [esi + 8]
call fcn.00408c37
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x18]
test eax, eax
push 0
cmovne ebx, eax
xor ecx, ecx
push ebx
test eax, eax
mov eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x2c]
sete cl
mov dword [esp + 0x20], eax
and dword [ebx], 0
push dword [esi + 0x21c]
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x24], 0
mov edi, eax
mov ebp, dword [ebx]
jbe 0x402def
test edi, edi
jne 0x402def
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x402dbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xa2
jne 0x402def
mov eax, dword [esp + 0x10]
sub eax, dword [ebx]
mov ecx, dword [esp + 0x20]
add ecx, dword [ebx]
push 0
push ebx
push eax
push ecx
push dword [esi + 0x21c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
add ebp, dword [ebx]
mov edi, eax
cmp dword [esp + 0x10], 0
jne 0x402da1
mov dword [ebx], ebp
add dword [esi + 0x220], ebp
adc dword [esi + 0x224], 0
test edi, edi
je 0x402e16
cmp dword [esp + 0x28], 0
jne 0x402e0f
cmp ebp, dword [esp + 0x24]
jne 0x402e16
mov eax, edi
jmp 0x402ed3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 8]
mov ebx, eax
push 3
call fcn.00408c37
mov ecx, dword [esi + 8]
push 1
push 0x43ae70
call fcn.00408b10
mov ecx, dword [esi + 8]
push ecx
test edi, edi
je 0x402e43
push 0
jmp 0x402e44
push ebx
call fcn.0040912f
push dword [esi + 0x21c]
push str._IXStream__Handle__p_
push dword [esi + 8]
call fcn.00408dff
push dword [esp + 0x20]
push str._IXStream__bExact__d_
push dword [esi + 8]
call fcn.00408dff
push ebp
push dword [esp + 0x40]
push str._IXStream__A_lire__u___lu__u_
push dword [esi + 8]
call fcn.00408dff
mov ecx, dword [esi + 0x220]
mov eax, dword [esi + 0x224]
sub ecx, ebp
sbb eax, 0
push eax
push ecx
push str._IXStream__Offset__I64u_
push dword [esi + 8]
call fcn.00408dff
add esp, 0x38
mov ecx, esi
call fcn.004028e7
push eax
push 0x6d63
push 0x43ae70
push dword [esi + 8]
call fcn.00408c70
add esp, 0x10
mov ecx, esi
call fcn.004028e7
mov ecx, dword [esi + 8]
push eax
push 1
call fcn.00408e88
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x403350
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push 1
mov ecx, dword [edi + 8]
call fcn.00408c37
mov eax, dword [ebp + 0x10]
sub eax, 0
je 0x403371
sub eax, 1
jne 0x403384
push 2
jmp 0x403373
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 8]
call dword [eax + 0x24]
test eax, eax
jne 0x40338b
xor eax, eax
jmp 0x403413
push dword [edi + 0x21c]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x403410
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi + 8]
mov esi, eax
push 3
call fcn.00408c37
mov ecx, dword [edi + 8]
mov ebx, 0x43ae70
push 1
push ebx
call fcn.00408b10
push ecx
mov ecx, dword [edi + 8]
push esi
call fcn.0040912f
push dword [edi + 0x21c]
push str._IXStream__Handle__p_
push dword [edi + 8]
call fcn.00408dff
add esp, 0xc
mov ecx, edi
call fcn.004028e7
push eax
push 0x6d64
push ebx
push dword [edi + 8]
call fcn.00408c70
add esp, 0x10
mov ecx, edi
call fcn.004028e7
mov ecx, dword [edi + 8]
push eax
push 1
call fcn.00408e88
pop esi
xor eax, eax
pop ebx
jmp 0x403413
xor eax, eax
inc eax
pop edi
pop ebp
ret 0xc

Function at 0x403a88
Capabilities:
Delete file

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x8001
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00403878
test eax, eax
je 0x403aef
push 1
mov esi, 0x43ae70
xor ecx, ecx
push esi
call fcn.00408b10
push ebp
push 0x6ddb
push esi
push 0
call fcn.00408c52
add esp, 0x10
xor ecx, ecx
push ebp
push 1
call fcn.00408e88
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x403af8
Capabilities:
Delete file

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x8001
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x403b75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x403b75
push ecx
mov edx, ebp
lea ecx, [esp + 0x10]
call fcn.0040401d
pop ecx
test eax, eax
je 0x403b71
mov edx, dword [esp + 0xc]
push ecx
and edx, 0xfffffffe
mov ecx, ebp
call fcn.004040c4
pop ecx
test eax, eax
je 0x403b71
pop edi
pop esi
mov ecx, ebp
pop ebp
add esp, 4
jmp fcn.00403a88
xor eax, eax
jmp 0x403baa
call fcn.00403878
test eax, eax
je 0x403ba8
push 1
mov edi, 0x43ae70
xor ecx, ecx
push edi
call fcn.00408b10
push ebp
push 0x6ddb
push edi
push 0
call fcn.00408c52
add esp, 0x10
xor ecx, ecx
push ebp
push 1
call fcn.00408e88
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x403c9e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x3a
pop eax
cmp ax, word [edi + edx*2 - 2]
jne 0x403cba
cmp byte [esp + 0x20], 0
je 0x403d0d
jmp 0x403cdf
push ecx
dec edx
call fcn.00407592
pop ecx
mov esi, eax
xor bl, bl
push 0x5c
pop ebp
test esi, esi
je 0x403cf4
lea eax, [edi + 2]
cmp eax, esi
jne 0x403ced
cmp word [edi], bp
jne 0x403ced
cmp byte [esp + 0x20], bl
je 0x403ceb
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x403d4f
mov bl, 1
xor eax, eax
cmp edi, esi
cmove esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403d09
mov ecx, eax
call fcn.00403d57
jmp 0x403d4f
test bl, bl
je 0x403d12
xor eax, eax
inc eax
jmp 0x403d4f
test esi, esi
je 0x403d31
xor eax, eax
mov edx, esi
sub edx, edi
mov word [esi], ax
push eax
sar edx, 1
mov ecx, edi
call fcn.00403c9e
pop ecx
test eax, eax
je 0x403ce7
mov word [esi], bp
and dword [esp + 0x14], 0
lea eax, [esp + 0x10]
and dword [esp + 0x18], 0
push eax
push edi
mov dword [esp + 0x18], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x403d6e
Capabilities:
Delete directory

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x8001
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00403878
test eax, eax
je 0x403dd5
push 1
mov esi, 0x43ae70
xor ecx, ecx
push esi
call fcn.00408b10
push ebp
push 0x6ddf
push esi
push 0
call fcn.00408c52
add esp, 0x10
xor ecx, ecx
push ebp
push 1
call fcn.00408e88
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x404039
Capabilities:
Get file attributes

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
mov ebp, edx
push 0x8001
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
call esi
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
call esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00403878
test eax, eax
je 0x4040b6
push 1
mov edi, 0x43ae70
xor ecx, ecx
push edi
call fcn.00408b10
mov esi, dword [esp + 0xc]
push esi
push dword [ebp]
push 0x6de2
push edi
push 0
call fcn.00408c52
add esp, 0x14
xor ecx, ecx
push esi
push 1
call fcn.00408e88
xor eax, eax
cmp dword [ebp], 0xffffffff
pop edi
pop esi
setne al
pop ebp
pop ecx
ret