joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fd40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e3f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x44d740]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], edx
mov eax, ecx
mov dword [ebp - 0x24], eax
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push eax
mov dword [ebp - 0x18], edi
mov dword [edx], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41fd9e
xor eax, eax
jmp 0x41fe2f
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41fdbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41fdc4
xor edi, edi
jmp 0x41fe16
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
push eax
call fcn.0042593d
add esp, 4
mov esi, eax
test esi, esi
je 0x41fe07
push 0
lea eax, [ebp - 0x18]
mov byte [edi + esi], 0
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41fe4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41fe50
push dword [ebp - 0x24]
push str.Failed_to_read_from_file:__s
call fcn.004012e0
add esp, 8
xor edi, edi
test esi, esi
je 0x41fe16
push esi
call fcn.00424bf6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41fe2d
test ebx, ebx
je 0x41fe2d
push ebx
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424436
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], edi
jne 0x41fdf7
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov edi, esi
jmp 0x41fe16
Function at 0x43792b
Capabilities:
Encode data using xor

Disassembly:
adc dword [0x4cb9c], esp
pop esp
add eax, 0xedf90005
adc dword [0x4f5e8], esp
push es
add al, 0
sbb esp, dword [eax + 0x13]
and eax, 0x4ebb8
invalid
and eax, 0x7084b
mov bl, 0x78
or al, 0
xor dh, cl
push ss
and eax, 0x4cea0
add al, 0xea
add al, 0
push esi
aaa
pop ss
and eax, 0x575da
loop 0x4378ee
add eax, 0x17c8c100
and eax, 0x56a30
adc al, 0x9b
add eax, 0x1922ff00
and eax, 0x554e2
mov edx, 0x1500055c
lahf
sbb dword [0x4d34c], esp
scasb al, byte es:[edi]
sti
add al, 0
lcall 0x4cb, 0x42251ac3
add byte [edx - 0x1efffb17], dh
xor bl, byte [ebx]
and eax, 0x4d51c
sbb dl, byte [eax + 0x1c1f2800]
and eax, 0x4d962
sal ch, 1
add al, 0
and al, 0x23
sbb al, 0x25
jbe 0x4379a0
add byte [esi], bh
mov dl, 5
add byte [edx + 0x78], cl
sbb al, 0x25
xchg ch, dl
add al, 0
dec edx
js 0x4379bf
and eax, 0x4d586
xchg edx, eax
add al, byte [0x1d0c9200]
and eax, 0x73727
fnstenv [edx + 0x7da8000c]
sbb eax, 0x4fb6c25
add byte [eax], bh
in eax, dx
add al, 0
mov dl, byte [ebx]
push ds
and eax, 0x6dd29
imul eax, dword [eax + 0xc], 0x1e2b3d00
and eax, 0x56786
push ds
test eax, 0xe3640005
push ds
and eax, 0x5a650
invalid
Function at 0x406f5a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 8
mov eax, 0x410fae
call fcn.0040f8b2
mov esi, ecx
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
cmp eax, 0x14
jb 0x406f8e
jne 0x406f7e
cmp dword [esi + 0x34], 0x5e
jb 0x406f8e
lea ecx, [esi + 0x3c]
call ebx
xor ecx, ecx
test al, al
sete cl
mov edi, ecx
jmp 0x406f90
xor edi, edi
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
and dword [ebp - 4], 0
test edi, edi
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
je 0x406fb6
add esi, 0x3c
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_class_CTXStringW_const__]
jmp 0x406fd7
lea eax, [ebp - 0x14]
push eax
call fcn.00406ea4
pop ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_class_CTXStringW_const__]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call edi
lea ecx, [ebp - 0x10]
call ebx
lea ecx, [ebp - 0x10]
test al, al
je 0x406ff1
or dword [ebp - 4], 0xffffffff
call edi
xor eax, eax
call fcn.0040f951
ret
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
jne 0x407012
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call edi
mov eax, esi
jmp 0x406feb
inc esi
jmp 0x407005

Function at 0x407015
Capabilities:
Enumerate files on windows

Disassembly:
push 0x25c
mov eax, 0x410fd2
call fcn.0040f91b
and dword [ebp - 4], 0
and dword [ebp - 0x264], 0
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
xor esi, esi
push eax
inc esi
call sub.MSVCR100.dll_memset
push 0x414b68
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4070dc
test esi, esi
je 0x4070d5
test byte [ebp - 0x260], 0x10
je 0x4070bd
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414b60
lea eax, [ebp - 0x234]
push eax
call esi
test eax, eax
je 0x4070c3
push 0x414b5c
lea eax, [ebp - 0x234]
push eax
call esi
test eax, eax
je 0x4070c3
inc dword [ebp - 0x264]
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x407086
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, dword [ebp - 0x264]
call fcn.0040f965
ret
Function at 0x4070ff
Capabilities:
Enumerate files on windows

Disassembly:
push 0x260
mov eax, 0x411010
call fcn.0040f91b
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x25c]
push ebx
xor esi, esi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x26c], ebx
inc esi
mov dword [ebp - 0x260], ebx
call sub.MSVCR100.dll_memset
push 0x414b68
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x264]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40720f
cmp esi, ebx
je 0x407208
test byte [ebp - 0x260], 0x10
je 0x4071f3
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414b60
lea eax, [ebp - 0x234]
push eax
call esi
test eax, eax
je 0x4071f3
push 0x414b5c
lea eax, [ebp - 0x234]
push eax
call esi
test eax, eax
je 0x4071f3
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea eax, [ebp - 0x234]
push eax
push 0x414b78
call esi
test eax, eax
jne 0x4071d7
mov dword [ebp - 0x268], 1
jmp 0x4071f3
lea eax, [ebp - 0x234]
push eax
push 0x414b70
call esi
test eax, eax
jne 0x4071f3
mov dword [ebp - 0x26c], 1
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
jmp 0x407178
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x419208], ebx
je 0x407241
cmp dword [ebp - 0x268], ebx
je 0x407269
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
xor eax, eax
call fcn.0040f965
ret
cmp dword [ebp - 0x26c], ebx
je 0x407269
xor edi, edi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, edi
jmp 0x40723b
xor edi, edi
inc edi
jmp 0x40724b
Function at 0x40726e
Capabilities:
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x41104d
call fcn.0040f91b
xor edi, edi
xor ebx, ebx
inc edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x26c], edi
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x264]
cmp dword [0x419208], ebx
je 0x4072b0
push 0x414b78
jmp 0x4072b5
push 0x414b70
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
push 0x24c
lea eax, [ebp - 0x25c]
push ebx
push eax
mov dword [ebp - 0x260], ebx
call sub.MSVCR100.dll_memset
push 0x414b68
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x268]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x40738d
cmp edi, ebx
je 0x407381
test byte [ebp - 0x260], 0x10
je 0x407364
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x414b60
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x407364
push 0x414b5c
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x407364
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x264]
call esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40737b
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
jmp 0x407313
mov dword [ebp - 0x26c], ebx
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x268]
call esi
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
mov eax, dword [ebp - 0x26c]
call fcn.0040f965
ret
Function at 0x4073d0
Capabilities:
Read .ini file
Write file on windows

Disassembly:
push 0x320
mov eax, 0x41108a
call fcn.0040f91b
xor edi, edi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
lea ecx, [ebp + 8]
test al, al
je 0x407403
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x407596
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
call esi
push eax
push edi
push str.UserDataSavePathType
mov ebx, str.UserDataSet
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x32c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x103
lea eax, [ebp - 0x318]
push eax
push 0x413658
push str.UserDataSavePath
push ebx
call edi
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
push 0x7f
lea eax, [ebp - 0x110]
push eax
push 0x413658
push str.NewVersion
push ebx
call edi
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x324], eax
cmp eax, edi
je 0x407509
xor eax, eax
and dword [ebp - 0x328], eax
push eax
lea edi, [ebp - 0x31b]
stosb byte es:[edi], al
lea eax, [ebp - 0x328]
push eax
push 2
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x324]
mov word [ebp - 0x31c], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x320]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push dword [ebp - 0x32c]
lea eax, [ebp - 0x320]
push 0x414268
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___cdecl_CTXStringW::Format_wchar_t_const__]
add esp, 0xc
lea ecx, [ebp + 8]
call esi
push eax
lea ecx, [ebp - 0x320]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.UserDataSavePathType
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x318]
push eax
push str.UserDataSavePath
push ebx
call edi
lea ecx, [ebp + 8]
call esi
push eax
lea eax, [ebp - 0x110]
push eax
push str.NewVersion
push ebx
call edi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call esi
call fcn.0040f965
ret
Function at 0x40763c
Capabilities:
Create directory
Delete file

Disassembly:
push 0xc
mov eax, 0x4110c4
call fcn.0040f8b2
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_public:_bool___thiscall_CTXStringW::IsEmpty_void_const]
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
test al, al
je 0x407673
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call edi
mov eax, ebx
call fcn.0040f951
ret 4
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push ebx
lea ecx, [ebp + 8]
call esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.testfile
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4076d1
push eax
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4076ff
lea eax, [ebp - 0x18]
push eax
push 0x413448
push str.StorageTool
push 2
push str.func
push 0x62
push str.file
mov dword [ebp - 0x18], 0x414b98
call fcn.004011f4
add esp, 0x1c
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call edi
mov ebx, dword [ebp - 0x14]
jmp 0x407660
Function at 0x407bd1
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push 8
mov eax, 0x4111ab
call fcn.0040f8b2
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
xor ebx, ebx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
inc ebx
push eax
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407c2c
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0xa
lea ecx, [ebp + 0xc]
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x407c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call edi
push str.MoveFileEx___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop ebx
push ebx
push str.func
push 0x121
push str.file
call fcn.00407b42
add esp, 0x24
cmp esi, 0x70
jne 0x407c8b
or ebx, 0xffffffff
jmp 0x407c9b
cmp esi, 0x50
je 0x407c9b
cmp esi, 0xb7
je 0x407c9b
push 0xfffffffffffffffd
pop ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, ebx
call fcn.0040f951
ret
Function at 0x407cc4
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes

Disassembly:
push 8
mov eax, 0x4111ab
call fcn.0040f8b2
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor ebx, ebx
inc ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
jne 0x407d11
mov edi, ebx
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, edi
call fcn.0040f951
ret
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_Util::FS::GetParentDir_class_CTXStringW_]
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call esi
push eax
call edi
cmp eax, 0xffffffff
jne 0x407d50
push 0
lea ecx, [ebp - 0x10]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp + 0x10]
xor edi, edi
lea ecx, [ebp + 0xc]
inc edi
call esi
push eax
lea ecx, [ebp + 8]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x407dc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call ebx
push str.CopyFile___s__to___s__fail_ErrorCode_lu
push str.StorageTool
push 2
pop edi
push edi
push str.func
push 0x14b
push str.file
call fcn.00407b42
add esp, 0x24
cmp esi, 0x70
jne 0x407db3
or edi, 0xffffffff
jmp 0x407dc3
cmp esi, 0x50
je 0x407dc3
cmp esi, 0xb7
je 0x407dc3
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
jmp 0x407cf1
Function at 0x407dd5
Capabilities:
Check if file exists
Create directory
Enumerate files on windows
Get file attributes

Disassembly:
push 0x26c
mov eax, 0x411208
call fcn.0040f91b
mov esi, dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
xor edi, edi
inc edi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x407e11
push 0
lea ecx, [ebp + 0xc]
call esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x264], edi
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
push 0x414b68
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x278]
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 2
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
je 0x407fc2
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
cmp dword [ebp - 0x264], 0
je 0x407fb6
test byte [ebp - 0x260], 0x10
jne 0x407f80
lea eax, [ebp - 0x234]
push eax
push 0x414d64
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
push 0x414d48
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
push str.CustomFaceRecv.db
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x407f80
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push eax
call edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 3
call edi
add esp, 0x18
push 1
push ecx
lea eax, [ebp - 0x268]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
mov byte [ebp - 4], 4
call ebx
push ecx
lea eax, [ebp - 0x26c]
mov ecx, esp
mov dword [ebp - 0x264], esp
push eax
mov byte [ebp - 4], 5
call ebx
mov byte [ebp - 4], 4
call fcn.00407cc4
add esp, 0xc
mov dword [ebp - 0x270], eax
cmp eax, 0xffffffff
je 0x407f9e
cmp eax, 0xfffffffd
je 0x407f9e
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x264], eax
jmp 0x407e87
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 3
call esi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call esi
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call esi
mov eax, dword [ebp - 0x270]
call fcn.0040f965
ret