joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
xor esi, esi
push esi
push eax
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push 0x8023
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, 0x57
lea edx, [ebp - 0x210]
test eax, eax
cmovs esi, ecx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x430e57
sub edx, ecx
lea eax, [ebp - 0x210]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.0040a3a8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 4

Function at 0x43361d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x433739
cmp dword [ebp + 0xc], 0
je 0x433739
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x4000
mov edi, eax
call fcn.0043cfd1
mov esi, eax
pop ecx
test esi, esi
jne 0x43365a
push 8
jmp 0x43372a
push edi
xor ebx, ebx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x43367c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x43372b
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x4000
push esi
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x4336a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43372b
mov eax, dword [ebp - 8]
mov ecx, ebx
shr eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], bl
test eax, eax
je 0x43371c
push 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push dword [esi + ecx*4]
mov dword [ebp - 0x14], ebx
push edi
mov dword [ebp - 0x10], ebx
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x4336ea
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 8]
jg 0x4336ea
mov eax, dword [ebp + 8]
sub eax, ecx
cmp eax, dword [ebp - 0x14]
jl 0x4336f8
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 8]
jb 0x4336bc
jmp 0x43371c
mov eax, dword [ebp - 0xc]
push 0x104
push dword [ebp + 0xc]
push dword [esi + eax*4]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x433716
mov byte [ebp - 1], 1
jmp 0x43371c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
jne 0x43372b
push 5
pop ebx
push esi
call fcn.0043cfda
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
jmp 0x43373c
push 0x57
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4337a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 3
pop esi
call fcn.00433871
mov ebx, eax
test ebx, ebx
je 0x433866
cmp byte [ebp + 8], 0
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [edi + edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
je 0x4337e7
push str.szInstallDir32
jmp 0x4337ec
push str.szInstallDir64
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x43385b
test esi, esi
je 0x43385b
push esi
call fcn.00443c45
pop ecx
mov ecx, edi
sub ecx, eax
sub ecx, 1
je 0x43382f
xor eax, eax
push esi
mov word [esi + edi*2 - 2], ax
call fcn.00443c45
mov ecx, edi
sub ecx, eax
dec ecx
push ecx
push 0x4b4444
push esi
call fcn.00451b0e
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x43385b
push esi
call fcn.00443c45
pop ecx
mov ecx, edi
sub ecx, eax
sub ecx, 1
je 0x43385b
push esi
call fcn.00443c45
sub edi, eax
dec edi
push edi
push dword [ebp + 0xc]
push esi
call fcn.00451b0e
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433e33
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.00433871
mov edi, eax
test edi, edi
je 0x433f0c
push ebx
mov ebx, 0x80
mov dword [esi], 0x5e0
push ebx
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x90], ebx
lea eax, [ebp - 0x90]
xor ebx, ebx
mov dword [ebp - 0x94], ebx
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x94]
push eax
push 2
push str.system_core_version
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x433efa
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], ebx
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
push eax
lea eax, [ebp - 0x84]
push str._lu._lu
push eax
call fcn.00433fa6
mov eax, dword [ebp - 0x8c]
add esp, 0x10
cmp eax, 0xf
jb 0x433efa
cmp dword [ebp - 0x88], 4
jb 0x433efa
imul eax, eax, 0x64
add eax, dword [ebp - 0x88]
mov dword [esi], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 4]
push eax
call fcn.00433dfd
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret

Function at 0x43493c
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x4ae322
call fcn.0043d05b
mov ebx, ecx
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x18]
xor edi, edi
mov dword [ebp - 0x224], ebx
mov dword [ebx], edi
mov ecx, esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], esi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.00435f9b
mov dword [esi], eax
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4349a9
mov eax, dword [esi]
jmp 0x4349ab
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
test eax, eax
je 0x4349c8
push eax
mov ecx, esi
call fcn.00402b60
jmp 0x434a36
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0043f630
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x218], 0
je 0x434a27
lea eax, [ebp - 0x218]
push eax
call fcn.00443c45
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00403c60
mov eax, ebx
call fcn.0043d005
ret 4
Function at 0x435d65
Capabilities:
Check if file exists
Copy file
Create directory
Move file

Disassembly:
push 0x234
mov eax, 0x4ae550
call fcn.0043d05b
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x14]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x435d99
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
add edi, 0x24
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 8
jb 0x435dab
mov eax, dword [edi]
jmp 0x435dad
mov eax, edi
push 1
push eax
lea ecx, [ebp - 0x240]
call fcn.00434a40
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0043f630
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x435dda
mov eax, dword [edi]
jmp 0x435ddc
mov eax, edi
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0040a523
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.trusted.tmp
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x435ea2
cmp dword [edi + 0x14], 8
jb 0x435e3e
mov eax, dword [edi]
jmp 0x435e40
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435e6c
cmp dword [edi + 0x14], 8
jb 0x435e55
mov eax, dword [edi]
jmp 0x435e57
mov eax, edi
push ebx
push ebx
push 2
push ebx
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
jmp 0x435e86
cmp dword [edi + 0x14], 8
jb 0x435e76
mov eax, dword [edi]
jmp 0x435e78
mov eax, edi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x435ec2
cmp dword [edi + 0x14], 8
jb 0x435e92
mov edi, dword [edi]
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x240]
call fcn.00434f54
test esi, esi
je 0x435eb8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, ebx
call fcn.0043d005
ret 4
lea ecx, [ebp - 0x240]
call fcn.00434f54
push str.67136527_5D6B_4AC9_865B_3E392E982420
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [ebp - 0x220]
call fcn.0043573b
mov ecx, dword [ebp - 0x220]
call fcn.00435995
mov ebx, eax
jmp 0x435ead
Function at 0x4360fb
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x4b13eb
call fcn.0043d05b
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x436202
cmp byte [ebx + 0x3e], 0
je 0x436202
mov eax, dword [ebx]
mov esi, 0xffff
push esi
call dword [eax + 0xc]
movzx eax, ax
cmp si, ax
sete al
test al, al
je 0x43613c
xor al, al
jmp 0x436204
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00436936
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x43619a
sub eax, 1
je 0x43619e
dec eax
sub eax, 1
je 0x4361f0
xor bl, bl
jmp 0x4361f2
mov byte [ebx + 0x3e], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4361d6
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00452bd2
add esp, 0x10
cmp esi, eax
jne 0x436196
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x4361f0
test esi, esi
jne 0x436160
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00436833
jmp 0x43615a
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00404651
mov al, bl
jmp 0x436204
mov al, 1
call fcn.0043d005
ret
Function at 0x4383c4
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4a8
mov eax, 0x4ae728
call fcn.0043d05b
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x4383e6
xor eax, eax
jmp 0x438577
lea ecx, [ebp - 0x2a4]
push 3
mov dword [ebp - 0x2a8], ecx
lea ecx, [ebp - 0x2a8]
push eax
call fcn.0043825d
mov ebx, 0x104
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0043f630
push ebx
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0043f630
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00438324
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.00438324
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x4c3cb4
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.0040a421
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
push 0x4385c8
push 0x4385ad
push 0x4385d1
push 0x4385bf
push 0x4385b6
push fcn.004385e3
push 0x4385da
call dword [edi + 4]
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x43855b
push 0x108
lea eax, [ebp - 0x4b4]
push esi
push eax
call fcn.0043f630
lea eax, [ebp - 0x4b4]
push eax
push esi
push 0x4385e8
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [edi + 8]
push ebx
call dword [edi + 0xc]
add esp, 0x2c
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x43855b
cmp dword [ebp - 0x4b4], 0
je 0x43854e
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0x3ac]
push 3
lea eax, [ebp - 0x4b0]
push eax
call fcn.004381a3
push dword [ebp - 0x3ac]
mov byte [ebp - 4], 1
call fcn.00432c83
mov esi, eax
lea eax, [ebp - 0x3a8]
pop ecx
cmp dword [ebp - 0x3ac], eax
je 0x43854e
push dword [ebp - 0x3ac]
call fcn.00443bd1
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2a4]
cmp dword [ebp - 0x2a8], eax
je 0x438575
push dword [ebp - 0x2a8]
call fcn.00443bd1
pop ecx
mov eax, esi
call fcn.0043d005
ret 4

Function at 0x45bb6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b82d

Function at 0x45bb75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b9ae

Function at 0x4601c5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004600ca
Function at 0x466d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00465fe0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push ebx
push dword [edi]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x466de1
push dword [edi]
call fcn.0043cfda
mov dword [edi], 0
push 0x4f562c
push dword [ebx]
call fcn.0043da5f
add esp, 0xc
mov dword [edi], eax
push ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x466dfc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x466e50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aec80
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ef340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x466f9a
mov ebx, dword [ebp + 0x14]
cmp ebx, 1
jb 0x466f9a
xor esi, esi
mov dword [ebp - 0x10], 0
mov dword [ebp + 0x14], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp ecx, 1
jne 0x466eef
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.00466580
mov ebx, eax
test ebx, ebx
jne 0x466f0b
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 0x10], esi
lea eax, [ebx + 0x20]
push eax
mov dword [ebp - 0x10], eax
call fcn.0043cfd1
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
jne 0x466f2d
lea ebx, [eax + 8]
jmp 0x466f72
cmp ecx, 7
jne 0x466ecb
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.004663c0
mov ebx, eax
test ebx, ebx
je 0x466ec2
mov esi, dword [ebp + 0x14]
push esi
call fcn.0043cfda
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 0x20]
push eax
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
call fcn.00466930
mov ebx, eax
test ebx, ebx
jne 0x466f72
push dword [ebp + 8]
lea ecx, [ebp + 0x10]
call fcn.00465fe0
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push edi
push 3
push ebx
push dword [ebp + 0x10]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp + 0x10]
mov ebx, eax
call fcn.00466140
push edi
call fcn.0043cfda
add esp, 4
push esi
call fcn.0043cfda
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x467d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x467d8c
xor ecx, ecx
cmp cx, word [eax]
je 0x467d8c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x467d88
test al, 0x10
je 0x467d88
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x467d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x467dbc
xor ecx, ecx
cmp cx, word [eax]
je 0x467dbc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x467db8
test al, 0x10
jne 0x467db8
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x468040
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeeb8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x468165
xor eax, eax
cmp ax, word [esi]
je 0x468165
mov ecx, 0x4b497c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4680ad
test dx, dx
je 0x4680a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4680ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x468087
xor eax, eax
jmp 0x4680b2
sbb eax, eax
or eax, 1
test eax, eax
je 0x468165
mov ecx, 0x4d4718
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4680e7
test dx, dx
je 0x4680e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4680e7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4680c1
xor eax, eax
jmp 0x4680ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x468165
push esi
call fcn.00467d60
add esp, 4
test al, al
je 0x468165
push esi
lea eax, [ebp - 0x28]
push str._s.
push eax
call fcn.0042a8a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 1
cmovae eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 4], 0
call fcn.00467930
add esp, 0x14
test al, al
jne 0x46813b
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.00403f10
mov al, bl
jmp 0x468167
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
lea ecx, [ebp - 0x28]
setne bl
call fcn.00403f10
mov al, bl
jmp 0x468167
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret
Function at 0x468190
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aeef6
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x4681c8
mov eax, dword [esi]
jmp 0x4681ca
mov eax, esi
push eax
call fcn.00467d60
add esp, 4
test al, al
je 0x4681de
xor eax, eax
jmp 0x46838e
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00403860
push 4
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
xor bl, bl
call fcn.004030c0
cmp dword [eax + 0x14], 8
lea ecx, [eax + 0x10]
jb 0x468221
mov eax, dword [eax]
push 4
push str.__
push dword [ecx]
push eax
call fcn.00402b00
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
mov edi, eax
cmp ecx, 8
jb 0x46824a
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00403e40
test edi, edi
jne 0x4682b3
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004030c0
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x468298
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x46827b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403e40
xor eax, eax
mov dword [ebp - 0x14], 7
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004035c0
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4682b1
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403e40
mov bl, 1
push 1
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x5c
push eax
lea ecx, [ebp - 0x28]
call fcn.004031a0
mov edi, eax
cmp edi, 0xffffffff
je 0x468375
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x5c
push eax
lea ecx, [ebp - 0x28]
call fcn.0042b4d0
cmp eax, 0xffffffff
je 0x468375
cmp edi, eax
je 0x468350
push eax
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004030c0
mov byte [ebp - 4], 2
test bl, bl
je 0x468336
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x58]
push str.__
push eax
call fcn.00467820
add esp, 0xc
lea ecx, [ebp - 0x40]
push eax
call fcn.0043c2af
lea ecx, [ebp - 0x58]
call fcn.00403f10
lea eax, [ebp - 0x40]
push eax
call fcn.00468190
add esp, 4
lea ecx, [ebp - 0x40]
mov edi, eax
call fcn.00403f10
test edi, edi
jne 0x468377
cmp dword [esi + 0x14], 8
jb 0x468358
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x468375
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x468377
xor edi, edi
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x46838c
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00403e40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret