joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f9d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100562e8
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x1002fa26
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x1002fa29
mov esi, dword [ebp + 8]
test esi, esi
je 0x1002fb10
call fcn.1002ca20
test eax, eax
je 0x1002faab
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1002fa45
xor ebx, ebx
jmp 0x1002fa75
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.10013b30
mov eax, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp + 0x18]
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1002fb04
cmp esi, dword [ebp + 8]
je 0x1002faa4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1002fb12
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.10014910
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1002faf5
cmp esi, dword [ebp + 8]
je 0x1002fadf
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.10015110
mov eax, 1
jmp 0x1002fb12
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.10015110
cmp esi, dword [ebp + 8]
je 0x1002fb10
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032a40
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.1002c9a0
test eax, eax
je 0x10032a5e
mov dword [0x10071e8c], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x10032a79
mov dword [0x10071e8c], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push 2
push edi
push edi
mov dword [0x10071e8c], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x10032aa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
je 0x10032aca
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x10032b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x10032b3f
jne 0x10032b08
test esi, esi
jne 0x10032aee
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x10032aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x10032b08
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x10032b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, eax
test ebp, ebp
jne 0x10032b5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x10071e8c], eax
jne 0x10032b48
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x10032b5f
mov eax, dword [0x10071e8c]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x10032b5f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10032b5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10071e8c], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x10032b6c
push edi
call ebx
test esi, esi
je 0x10032b73
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x10032d80
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.1002c9a0
test eax, eax
je 0x10032d9c
mov dword [0x10071e8c], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x10071e8c], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x10032ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x10032df9
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10032e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x10032e4f
jne 0x10032e33
test esi, esi
jne 0x10032e1d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10032e1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x10032e33
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10032e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x10032e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10032e53
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x10032e5f
mov dword [0x10071e8c], ebx
jmp 0x10032e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10071e8c], eax
jmp 0x10032e76
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x10032e83
push edi
call ebx
test esi, esi
je 0x10032e8a
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10033750
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x100567cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call sub.MFC42.DLL_CStringArray::CStringArray
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x10033794
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CStringArray::Append
mov eax, dword [esp + 0x660]
test eax, eax
je 0x100337a9
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CStringArray::Append
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x10033828
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.10050310
add esp, 0x10
test eax, eax
jne 0x10033821
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.100135ee
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x100338e1
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x100338e1
test esi, esi
je 0x100338e1
call fcn.1004bbc0
mov eax, dword [0x100725d0]
test eax, eax
je 0x100338e1
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.1004f350
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x100725d0]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.100135ee
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x10034090
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x100340ad
cmp edi, 4
jbe 0x100340ad
mov dword [0x10071e90], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x100340cc
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.1002ad00
cmp edi, 0xffffffff
je 0x100340e0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.1002ad00
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x100340f8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.1002ad00
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1003410e
push eax
mov eax, dword [str.DisplayName]
push eax
mov ecx, esi
call fcn.1002aeb0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10034125
mov ecx, dword [str.Description]
push eax
push ecx
mov ecx, esi
call fcn.1002aeb0
mov edx, dword [esp + 0x28]
test edx, edx
je 0x1003414b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10034161
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.1002aeb0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10034178
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.1002b370
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1003418f
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.1002b370
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x10034ee0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100569e0
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x10034f13
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x10034f2a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.10029ac0
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.10029be0
test eax, eax
je 0x10034fd6
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.1002c0f0
test eax, eax
jne 0x10034f8b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10029b60
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x10034fbe
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.1002a1f0
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.100135b2
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x1003509e
mov dword [eax], 0x10
jmp 0x1003509e
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push edx
lea eax, [esp + 0x24]
push 0x100603c0
push eax
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x2c]
add esp, 0x10
push 0x20019
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
call fcn.10029be0
test eax, eax
jne 0x1003504a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.100135b2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10029b60
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x10035082
mov edx, dword [str.StaticVxD]
lea eax, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0xc]
call fcn.1002a1f0
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.100135b2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10035090
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.100135b2
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10029b60
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100350d0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10056a08
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x100351df
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x100351df
cmp byte [edi], bl
je 0x100351df
cmp byte [esi], bl
je 0x100351df
lea ecx, [esp + 0xc]
call fcn.10029ac0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x1003517d
cmp eax, 1
je 0x1003517d
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.10029be0
test eax, eax
jne 0x1003516b
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.10029c50
test eax, eax
je 0x100351ce
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.1002aeb0
mov esi, eax
jmp 0x10035263
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push edx
lea eax, [esp + 0x2c]
push 0x100603c0
push eax
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x34]
add esp, 0x10
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.10029be0
test eax, eax
jne 0x100351f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.100135b2
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10029b60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_1
push 0x5c
push esi
mov byte [esp + 0x24], 2
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
cmp eax, ebx
je 0x1003521c
inc eax
lea ecx, [esp + 0x2c]
push eax
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x10035235
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.100135b2
jmp 0x100351c1
mov edx, dword [str.StaticVxD]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.1002aeb0
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.100135b2
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.100135b2
lea ecx, [esp + 0xc]
call fcn.10029c30
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10029b60
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1003c8a0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x10057015
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], ebx
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x104
push eax
push 0x1006366c
mov dword [esp + 0x334], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebx
jbe 0x1003ca20
cmp eax, 0x104
jae 0x1003ca20
lea ecx, [esp + 0x14]
push ecx
call fcn.10036840
add esp, 4
test eax, eax
je 0x1003c992
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x21c]
push 0x104
lea eax, [esp + 0x18]
push edx
push eax
call fcn.10036430
lea ecx, [esp + 0x228]
push 0x103
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
mov byte [esp + 0x117], bl
lea eax, [esp + 0x118]
test eax, eax
je 0x1003ca0f
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x1003ca0f
mov eax, dword [esp + 0x334]
cmp eax, ebx
je 0x1003c9d3
lea edx, [esp + 0x14]
push eax
push edx
push 0x100603c0
lea eax, [esp + 0x124]
push 0x104
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
jmp 0x1003ca0f
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x1003ca0f
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0x330]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x328], bl
call fcn.100135b2
mov ecx, dword [esp + 0x320]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x320
ret
Function at 0x10040170
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
test ebx, ebx
jne 0x1004018c
xor eax, eax
pop ebx
add esp, 0x104
ret
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call dword [sym.imp.MSVCRT.dll_strncpy]
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10040248
lea edx, [esp + 0x10]
mov byte [esi], 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x1004020b
test bl, 1
je 0x100401fa
and al, 0xfe
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x1004027e
cmp ebx, 0xffffffff
je 0x10040214
test edi, edi
jne 0x10040223
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x1004027e
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100401d0
test ebp, ebp
je 0x1004027e
mov ebx, dword [esp + 0x118]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10040273
test al, 0x10
jne 0x1004027e
test al, 1
je 0x10040266
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x1004027e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x10040290
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x100402ac
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1004036f
lea edx, [esp + 0x10]
mov word [esi], 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x1004032e
test bl, 1
je 0x1004031d
and al, 0xfe
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x100403a5
cmp ebx, 0xffffffff
je 0x10040337
test edi, edi
jne 0x10040346
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x100403a5
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100402f1
test ebp, ebp
je 0x100403a5
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004039a
test al, 0x10
jne 0x100403a5
test al, 1
je 0x1004038d
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x100403a5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret