joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a320
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bdc50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x68de04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x20dec], 0
je 0x40a377
push 0
push 0x34b
push str..Updater.cpp
push str.status___STATUS_Checking
call fcn.00569800
add esp, 0x10
mov ecx, esi
call fcn.00408890
call fcn.00408ac0
test al, al
je 0x40a3a2
mov ecx, esi
call fcn.00408b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esi + 0x98], 1
call fcn.00408e00
mov dword [esi + 0x20dec], eax
lea eax, [esi + 0x20df5]
push 0x660882
push eax
call fcn.00401ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov ebx, 5
cmp dword [esi + 0x20dec], ebx
jne 0x40a4d3
mov ecx, dword [esi + 0x21878]
mov eax, dword [0x73a460]
or eax, dword [0x73a464]
mov dword [0x73a450], ecx
mov edx, dword [esi + 0x2187c]
mov dword [0x73a454], edx
je 0x40a42c
call fcn.00402a60
test al, al
je 0x40a42c
push 0
push 0
push 0x73a450
push 0x402720
push 0
push 0
call fcn.0058fcb7
add esp, 0x18
mov dword [0x73a618], eax
call fcn.00408e60
call fcn.00408fb0
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x5e4]
push ecx
push eax
push str.current_build_version_d__updater_data_version_d_n
call fcn.005694f0
mov eax, dword [esi + 0x5e4]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jne 0x40a460
mov eax, esi
call fcn.0040a250
mov ebx, esi
call fcn.00409250
mov ecx, esi
call fcn.00409950
call fcn.0040a1b0
push str.Validating_game_data_n
call fcn.005694f0
add esp, 4
lea edx, [esi + 0x20df5]
push str.Validating_game_data
push edx
call fcn.00401ac0
add esp, 8
lea eax, [esi + 0x21600]
push eax
lea ecx, [esi + 0x215f8]
push ecx
push 0
lea ecx, [esi + 0x4e0]
call fcn.0057b0b0
test al, al
jne 0x40a4bf
push str.Game_data_is_damaged__please_restart_launcher_to_repair_damaged_files
mov eax, esi
call fcn.00408830
push str.Validating_game_data___finished_n
call fcn.005694f0
add esp, 4
mov eax, esi
call fcn.0040a250
push 0x32
call edi
jmp 0x40a3d3

Function at 0x40ba30
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x216c8], 0
je 0x40ba52
push 0
push 0x5ef
push str..Updater.cpp
push str.mainThread___NULL
call fcn.00569800
add esp, 0x10
cmp dword [esi + 0x2170c], 0
je 0x40ba74
push 0
push 0x5f0
push str..Updater.cpp
push str.loginThread___NULL
call fcn.00569800
add esp, 0x10
push ebx
push edi
push 0
push 0
push esi
push 0x40a5a0
push 0
push 0
call fcn.0058fcb7
push 0
push 0
push esi
push 0x40ae70
push 0
push 0
mov dword [esi + 0x216c8], eax
call fcn.0058fcb7
add esp, 0x30
mov dword [esi + 0x21dc4], eax
lea edi, [esi + 0x216d8]
mov ebx, 0xc
push 0
push 0
push esi
push 0x40ae80
push 0
push 0
call fcn.0058fcb7
mov dword [edi], eax
add esp, 0x18
add edi, 4
sub ebx, 1
jne 0x40bab6
pop edi
pop ebx
ret
Function at 0x40bb60
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, eax
call fcn.005694f0
add esp, 4
cmp byte [esi + 0x20df4], 0
jne 0x40bb83
mov eax, dword [esi + 0x216d0]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x71d1e4
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x216c8]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x40bbc8
push ebx
push eax
call edi
mov ecx, dword [esi + 0x216c8]
push ecx
call ebp
mov dword [esi + 0x216c8], ebx
mov eax, dword [esi + 0x21dc4]
cmp eax, ebx
je 0x40bbe5
push ebx
push eax
call edi
mov edx, dword [esi + 0x21dc4]
push edx
call ebp
mov dword [esi + 0x21dc4], ebx
mov eax, dword [esi + 0x2170c]
cmp eax, ebx
je 0x40bc02
push ebx
push eax
call edi
mov eax, dword [esi + 0x2170c]
push eax
call ebp
mov dword [esi + 0x2170c], ebx
add esi, 0x216d8
mov ebx, 0xc
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x40bc26
push 0
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x40bc10
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x71d1e4
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40dcb0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x11
mov dword [esp + 0xc], 4
call fcn.00590dc3
mov edi, eax
push 0x288
mov dword [esp + 0x14], edi
call fcn.00590dc3
mov esi, eax
add esp, 8
test esi, esi
jne 0x40dcea
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.00590e8d
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40dd1a
mov ecx, dword [esp + 8]
push ecx
call fcn.00590dc3
mov esi, eax
add esp, 4
test esi, esi
jne 0x40dd1a
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.00590e8d
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40dd85
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.00406820
push edi
add esi, 0x1b0
push esi
push str.Address:__s__mac:__s_n
call fcn.00590e8d
add esp, 0x2c
mov eax, edi
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.00590f52
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x40e090
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e0e9
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e0c0
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.username
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40e0f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareArktos_Entertainment_GroupWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e140
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.username
push eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4

Function at 0x40e150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e184
mov ecx, esi
call fcn.0040e1c0
mov al, 1
pop esi
add esp, 8
ret
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
add esi, 0x100
push esi
push 0
push 0
push str.hardwareid
push edx
mov dword [esp + 0x20], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 8
ret

Function at 0x40e1c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d4
mov eax, dword [0x68de04]
xor eax, esp
mov dword [esp + 0x1d0], eax
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push bind
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e270
push 0x1c8
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00592e70
add esp, 0xc
lea eax, [esp + 8]
call fcn.004021b0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
add esi, 0x100
push str.0x_I64x
mov edx, esi
call fcn.0040e410
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e245
mov ecx, dword [esp + 4]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.hardwareid
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1d4]
pop esi
xor ecx, esp
call fcn.0058f377
mov esp, ebp
pop ebp
ret
Function at 0x40e290
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e2e6
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
add edx, 0x132
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Identifier
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4
Function at 0x42ea00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af1b7
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x68de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.004256c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.004256c0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.00427850
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00427850
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00428180
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.00428180
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.0045b190
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0045b210
movzx edx, al
test edx, edx
je 0x42eade
lea ecx, [ebp - 0x1bc]
call fcn.00426ad0
push eax
lea ecx, [ebp - 0x134]
call fcn.00426ad0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x42ebbc
lea ecx, [ebp - 0x134]
call fcn.00425850
test eax, eax
jg 0x42eb00
lea ecx, [ebp - 0x1bc]
call fcn.00425850
test eax, eax
jle 0x42eb93
lea ecx, [ebp - 0x24c]
call fcn.004256c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.004256c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.0042ec30
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.0042ec30
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.00426160
push eax
lea ecx, [ebp - 0x24c]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.004257d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.004257d0
jmp 0x42ebbc
lea ecx, [ebp - 0x1bc]
call fcn.00426160
push eax
lea ecx, [ebp - 0x134]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x42ebd5
cmp dword [ebp + 0x10], 0
je 0x42ebd5
mov ecx, dword [ebp + 0x10]
call fcn.00442d10
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0045b1f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.004257d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.004257d0
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f377
mov esp, ebp
pop ebp
ret
Function at 0x42ed60
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af23c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x68de04]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.004256c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00427850
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00428180
lea ecx, [ebp - 0x134]
call fcn.0045b190
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.0045b210
movzx ecx, al
test ecx, ecx
je 0x42ee28
lea ecx, [ebp - 0x94]
call fcn.00426ad0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004257d0
mov al, byte [ebp - 0x255]
jmp 0x42effb
lea ecx, [ebp - 0x94]
call fcn.00425850
cmp eax, 0x104
jle 0x42ef2e
lea ecx, [ebp - 0x1bc]
call fcn.004256c0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.0042e690
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.004256c0
mov byte [ebp - 4], 3
push 0x5fd594
lea ecx, [ebp - 0x24c]
call fcn.00427310
lea ecx, [ebp - 0x1bc]
call fcn.00427530
push eax
lea ecx, [ebp - 0x24c]
call fcn.00427310
lea ecx, [ebp - 0x24c]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x42eecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42eecf
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.004257d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.004257d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004257d0
mov al, byte [ebp - 0x256]
jmp 0x42effb
lea ecx, [ebp - 0x94]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x42efa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x42ef8e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00442db0
lea ecx, [ebp - 0x94]
call fcn.00427530
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x42efa1
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004257d0
mov al, byte [ebp - 0x257]
jmp 0x42effb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0058f377
mov esp, ebp
pop ebp
ret
Function at 0x42ffd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af3f1
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x68de04]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.00425850
test eax, eax
jne 0x43003b
cmp dword [ebp + 0x14], 0
je 0x430034
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x4301a4
lea ecx, [ebp - 0x94]
call fcn.004256c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00427850
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00428180
lea ecx, [ebp - 0x94]
call fcn.00425850
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.0045b190
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x4300ec
lea ecx, [ebp - 0x94]
call fcn.004267b0
movzx ecx, al
test ecx, ecx
jne 0x4300bb
lea ecx, [ebp - 0x134]
call fcn.0045b210
movzx edx, al
test edx, edx
je 0x4300ec
lea ecx, [ebp - 0x94]
call fcn.00426ad0
push eax
call fcn.00431e40
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x4300e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x43016c
cmp dword [ebp - 0x138], 0
jle 0x430142
lea ecx, [ebp - 0x1c4]
call fcn.004256c0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.0042ec30
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00426180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.004257d0
jmp 0x430159
lea ecx, [ebp - 0x94]
call fcn.00426180
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x43016c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004257d0
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0058f377
mov esp, ebp
pop ebp
ret
Function at 0x430560
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af39c
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x68de04]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x13c]
call fcn.004256c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00427850
push 0x5c
push 0x2f
lea ecx, [ebp - 0x13c]
call fcn.00428180
lea ecx, [ebp - 0xac]
call fcn.0045b190
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xac]
call fcn.0045b210
movzx ecx, al
test ecx, ecx
je 0x430604
push 0
lea ecx, [ebp - 0x13c]
call fcn.00426ad0
push eax
call fcn.00431e00
add esp, 8
mov dword [ebp - 0xb0], eax
jmp 0x43067d
lea ecx, [ebp - 0x13c]
call fcn.00425850
test eax, eax
jle 0x430663
lea ecx, [ebp - 0x1c4]
call fcn.004256c0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.0042ec30
add esp, 8
push 0
lea ecx, [ebp - 0x1c4]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.004257d0
jmp 0x43067d
push 0
lea ecx, [ebp - 0x13c]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x4306d3
cmp dword [ebp + 0xc], 0
je 0x4306d3
lea ecx, [ebp - 0x1ec]
call fcn.0042ae50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ec]
call fcn.0042e100
lea ecx, [ebp - 0x1ec]
call fcn.004c2de0
push eax
push str.errorMsg
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
call fcn.0042b220
cmp dword [ebp - 0xb0], 0
setne cl
mov byte [ebp - 0x1ed], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.004257d0
mov al, byte [ebp - 0x1ed]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058f377
mov esp, ebp
pop ebp
ret
Function at 0x430730
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af3f1
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x68de04]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.004256c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00427850
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00428180
push 0
push 1
lea ecx, [ebp - 0x94]
push ecx
call fcn.0042f020
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.0045b190
mov byte [ebp - 4], 1
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x134]
call fcn.0045b210
movzx edx, al
test edx, edx
je 0x4307ef
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x94]
call fcn.00426ad0
push eax
call fcn.00431e20
add esp, 8
movzx ecx, al
mov dword [ebp - 0x138], ecx
jmp 0x43086c
lea ecx, [ebp - 0x94]
call fcn.00425850
test eax, eax
jle 0x430850
lea ecx, [ebp - 0x1c4]
call fcn.004256c0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.0042ec30
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.004257d0
jmp 0x43086c
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x94]
call fcn.00426160
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045b1f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004257d0
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0058f377
mov esp, ebp
pop ebp
ret

Function at 0x431e20
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret