joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4743f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x47441f
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00507712
add esp, 0x1c
ret 8
cmp dword [ebp + 0xc], 1
jne 0x474430
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp + 4], eax
push esi
push edi
cmp dword [ebp + 0xc], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x474492
xor esi, esi
test ebx, ebx
je 0x4744b9
jmp 0x474450
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x474460
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
je 0x4744b9
add esi, 0x4000
cmp esi, ebx
jb 0x474450
jmp 0x4744b1
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
jne 0x4745ba
cmp byte [ebp + 0x1a], 0
je 0x4745ba
cmp dword [ebp + 0xc], 0
jne 0x4745ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x540780]
mov ecx, ebp
call esi
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x24]
push eax
mov dword [esp + 0x24], edx
call fcn.00475200
push edi
mov dword [esp + 0x1c], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x474551
ja 0x474513
cmp dword [esp + 0x18], ebx
jbe 0x474551
mov esi, dword [esp + 0x1c]
mov edx, esi
mov edi, dword [esp + 0x20]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x474551
jl 0x47452e
cmp edx, 0xffffffff
ja 0x474551
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x24], ecx
js 0x474551
jg 0x474541
cmp eax, 0xffffffff
jbe 0x474551
lea esi, [ebp + 0x24]
mov ecx, 0x5b77e4
push esi
call fcn.0046ea40
jmp 0x474554
lea esi, [ebp + 0x24]
push 0
push esi
mov ecx, 0x5b77e4
call fcn.0046e3a0
test al, al
je 0x4745aa
mov eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x474432
test eax, eax
je 0x474432
mov edi, dword [ebp]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x540780]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x18]
mov esi, dword [edi + 0x10]
mov ecx, esi
sbb edx, 0
push edx
push eax
call dword [0x540780]
mov ecx, ebp
call esi
jmp 0x474432
lea edx, [ebp + 0x24]
mov ecx, 0x5b77e4
push edx
push 0
call fcn.0046e9f0
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 8], 1
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1c
ret 8
Function at 0x474650
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b288
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x5755c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0
jbe 0x4746c3
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov eax, 0x54
mov word [ebp - 0x20], ax
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
test ecx, ecx
je 0x4746ec
cmp byte [esi + 0x10], 0
je 0x4746e2
mov eax, dword [esi + 8]
add eax, eax
push eax
push ecx
call fcn.0049b220
push dword [esi]
call fcn.00524aa2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x474c40
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x474c97
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004858d0
test al, al
je 0x474c97
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x474c99
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4

Function at 0x474cc0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x474d17
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004858d0
test al, al
je 0x474d17
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x474d19
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4
Function at 0x474e10
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b351
mov eax, dword fs:[0]
push eax
mov eax, 0x71a0
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00485b10
test al, al
je 0x47509b
push esi
call fcn.004755b0
test al, al
je 0x47509b
movzx eax, word [esi]
push eax
push 0x55065c
lea eax, [ebp - 0x2010]
push 0x800
push eax
call fcn.00402930
movzx eax, word [ebp - 0x2010]
add esp, 0x10
push eax
push 0x89
call fcn.00452430
lea ecx, [ebp - 0x2070]
call fcn.0049dc70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2070]
call fcn.0049dd10
push 2
push 0
push 2
lea eax, [ebp - 0x2070]
push eax
lea ecx, [ebp - 0x71ac]
call fcn.00499e20
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30b8]
push eax
lea ecx, [ebp - 0x71ac]
mov dword [ebp - 0x20a8], 0
mov dword [ebp - 0x20a4], 0
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
mov dword [ebp - 0x2098], 0
mov dword [ebp - 0x2094], 0
call fcn.0049aaf0
test eax, eax
jne 0x475054
jmp 0x474f30
mov ax, word [ebp - 0x30b8]
cmp ax, word [esi]
jne 0x475054
cmp word [ebp - 0x30b6], 0x3a
jne 0x475054
push 0
lea eax, [ebp - 0x30b8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
test al, al
jne 0x474f91
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.004858d0
test al, al
je 0x474f91
push 0
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebp - 0x20ac], 0
lea eax, [ebp - 0x30b8]
push eax
je 0x474fdf
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
test al, al
jne 0x47503a
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.004858d0
test al, al
je 0x47503a
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x47503a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
jne 0x47503a
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.004858d0
test al, al
je 0x475020
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
jne 0x47503a
lea eax, [ebp - 0x30b8]
push eax
push 0
push 0xe
call fcn.004158e0
mov ecx, 0x5b77e4
call fcn.0046e910
lea eax, [ebp - 0x30b8]
push eax
lea ecx, [ebp - 0x71ac]
call fcn.0049aaf0
test eax, eax
je 0x474f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x71ac]
call fcn.00499f10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2070]
test ecx, ecx
je 0x47509b
cmp byte [ebp - 0x2060], 0
je 0x475092
mov eax, dword [ebp - 0x2068]
add eax, eax
push eax
push ecx
call fcn.0049b220
mov ecx, dword [ebp - 0x2070]
push ecx
call fcn.00524aa2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507712
mov esp, ebp
pop ebp
ret 4
Function at 0x4750c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x475113
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004858d0
test al, al
je 0x475110
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop edi
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4

Function at 0x475130
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
cmp dword [ecx + 0x14], 0
jbe 0x475185
xor eax, eax
mov dword [ecx + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov eax, 0x54
mov word [esp + 0x10], ax
mov eax, dword [ecx]
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x475190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4751e2
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.004858d0
test al, al
je 0x4751e0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4751e2
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4

Function at 0x475200
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.004855a0
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x475291
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x475291
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.00507712
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.00507712
add esp, 0x101c
ret 4
Function at 0x475480
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
lea ecx, [esp + 0x20c]
push 0x800
push ecx
push eax
call fcn.00485630
push 0x105
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x475584
mov ecx, 0x550648
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47550a
test dx, dx
je 0x475506
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47550a
add eax, 4
add ecx, 4
test dx, dx
jne 0x4754e4
xor eax, eax
jmp 0x47550f
sbb eax, eax
or eax, 1
test eax, eax
je 0x475568
mov ecx, str.FAT32
lea eax, [esp]
jmp 0x475520
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x475546
test dx, dx
je 0x475542
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x475546
add eax, 4
add ecx, 4
test dx, dx
jne 0x475520
xor eax, eax
jmp 0x47554b
sbb eax, eax
or eax, 1
test eax, eax
je 0x475568
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.00507712
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.00507712
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor al, al
xor ecx, esp
call fcn.00507712
add esp, 0x1210
ret 4

Function at 0x4755b0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
lea ecx, [esp]
push 0x800
push ecx
push eax
call fcn.00485630
movzx eax, word [esp]
lea ecx, [esp]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x475615
cmp eax, 5
je 0x475615
xor al, al
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
mov al, 1
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4
Function at 0x475640
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.004861f0
movzx eax, word [eax]
cmp eax, 0x2e
je 0x475680
cmp eax, 0x20
je 0x475680
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4756d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x475706
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004858d0
test al, al
je 0x4756b0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x475706
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475706
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x475706
cmp byte [esp + 0x1010], 0
je 0x4756ec
push dword [esp + 0x1014]
push esi
call fcn.00475cd0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x47571b
cmp eax, 3
mov eax, 1
jne 0x475720
mov eax, 2
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 0xc
Function at 0x475740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x107c
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1078], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1090]
mov esi, edi
lea ecx, [esi + 2]
jmp 0x475770
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x475770
sub esi, ecx
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x1c]
sar esi, 1
mov dword [esp + 0x20], 0
call fcn.0049f220
lea ecx, [esp + 0x1c]
call fcn.0049f080
push 0
push 0x186a0
push edx
push eax
call fcn.00507be0
mov ebp, eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x10], eax
mov ecx, ebp
mov eax, 0x4f8b588f
xor ebx, ebx
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xf
mov dword [esp + 0x14], eax
imul eax, eax, 0xc350
sub ecx, eax
lea eax, [esp + 0x24]
push ecx
push dword [esp + 0x14]
push str._u._03u
push 0x32
push eax
call fcn.00402930
lea ecx, [esp + 0x38]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475801
mov ebp, dword [esp + 0x1094]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
cmp eax, ebp
jae 0x4758c9
cmp ebx, 0x3e8
je 0x4758c9
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [edi + esi*2]
push eax
call fcn.0049dc20
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47587b
push 0x800
lea eax, [esp + 0x8c]
push eax
push edi
call fcn.004858d0
test al, al
je 0x4758e6
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4758e6
imul eax, dword [esp + 0x14], 0xc350
inc ebx
mov ecx, ebx
sub ecx, eax
lea eax, [esp + 0x24]
add ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x14]
push str._u._03u
push 0x32
push eax
call fcn.00402930
lea eax, [esp + 0x38]
add esp, 0x14
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4758b0
sub eax, edx
sar eax, 1
add eax, esi
cmp eax, ebp
jb 0x475822
xor eax, eax
mov ecx, dword [esp + 0x1088]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x107c
ret 8
mov eax, edi
jmp 0x4758cb

Function at 0x4758f0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x47593e
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.004858d0
test al, al
je 0x47593e
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 4
Function at 0x475960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1068
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1064], eax
push ebx
mov ebx, dword [esp + 0x1078]
push ebp
mov ebp, dword [esp + 0x1074]
push esi
push edi
mov edi, dword [esp + 0x1080]
push ebx
push ebp
push edi
call fcn.0049dc20
push 0x32
push str.temp
lea eax, [esp + 0x18]
push eax
call fcn.0049dc20
xor esi, esi
lea esp, [esp]
push 0x2e
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0x3e8]
push 0
push eax
call fcn.0049da10
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00486320
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x475a01
push 0x800
lea eax, [esp + 0x78]
push eax
push edi
call fcn.004858d0
test al, al
je 0x475a0a
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x475a0a
inc esi
cmp esi, 0x3e8
jb 0x4759b0
push edi
push ebp
call fcn.00475a30
mov ecx, dword [esp + 0x1074]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1068
ret 0xc

Function at 0x475a30
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x2014]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test bl, bl
jne 0x475aaf
push 0x800
lea eax, [esp + 0x1010]
push eax
push edi
call fcn.004858d0
test al, al
je 0x475aaf
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475aaf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x475ab1
mov al, bl
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x2004
ret 8
Function at 0x475ad0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x1028
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1024], eax
mov ecx, dword [esp + 0x1038]
push ebx
push ebp
mov ebp, dword [esp + 0x103c]
push esi
mov esi, dword [esp + 0x1038]
push edi
mov edi, dword [esp + 0x1040]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x475b1c
mov eax, dword [edi]
or eax, dword [edi + 4]
mov byte [esp + 0x10], 1
jne 0x475b21
mov byte [esp + 0x10], 0
test ebp, ebp
je 0x475b32
mov eax, dword [ebp]
or eax, dword [ebp + 4]
mov byte [esp + 0x12], 1
jne 0x475b37
mov byte [esp + 0x12], 0
test ecx, ecx
je 0x475b47
mov eax, dword [ecx]
or eax, dword [ecx + 4]
mov byte [esp + 0x11], 1
jne 0x475b4c
mov byte [esp + 0x11], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x475b80
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475bba
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x475bba
test bl, 1
je 0x475bba
push 0
push esi
mov byte [esp + 0x1b], 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x475bbf
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475bbf
push 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x475bbf
mov byte [esp + 0x13], 0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x475c23
push 0x800
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475cae
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x475cae
cmp byte [esp + 0x10], 0
je 0x475c36
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.0049f090
cmp byte [esp + 0x12], 0
je 0x475c49
lea eax, [esp + 0x2c]
mov ecx, ebp
push eax
call fcn.0049f090
cmp byte [esp + 0x11], 0
je 0x475c5e
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
call fcn.0049f090
movzx eax, byte [esp + 0x10]
lea ecx, [esp + 0x1c]
neg eax
mov edi, dword [esp + 0x14]
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x24]
push eax
movzx eax, byte [esp + 0x15]
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x30]
push eax
movzx eax, byte [esp + 0x1a]
neg eax
sbb eax, eax
and eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0
je 0x475cae
push ebx
push esi
call fcn.00475cd0
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1028
ret 0x10
Function at 0x475cd0
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
push dword [esp + 0x1014]
mov esi, dword [esp + 0x1014]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x475d35
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475d35
push dword [esp + 0x1014]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
jmp 0x475d37
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x1004
ret 8

Function at 0x475e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b3cb
mov eax, dword fs:[0]
push eax
mov eax, 0x2054
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00485c90
test al, al
je 0x475ee9
lea ecx, [ebp - 0x1018]
call fcn.00476960
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1018]
push esi
call fcn.00476b60
push 0
lea eax, [ebp - 0x2060]
mov dword [ebp - 0x1050], 0
push eax
lea ecx, [ebp - 0x1018]
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0
call fcn.00476a40
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1018]
call fcn.00476980
mov al, bl
jmp 0x475f22
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x475f1f
push 0x800
lea eax, [ebp - 0x1010]
push eax
push esi
call fcn.004858d0
test al, al
je 0x475f1c
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507712
mov esp, ebp
pop ebp
ret 4