joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40853b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, 0x58000143
mov edx, dword [ebp - 0x304]
mov ax, word [edx]
mov word [ebp - 0x39a], ax
mov ecx, dword [ebp - 0x304]
add ecx, 2
mov dword [ebp - 0x304], ecx
mov dx, word [ebp - 0x39a]
mov word [ebp - 0x90], dx
mov eax, dword [ebp - 0x308]
mov cx, word [eax]
mov word [ebp - 0x39c], cx
mov edx, dword [ebp - 0x308]
add edx, 2
mov dword [ebp - 0x308], edx
mov ax, word [ebp - 0x39c]
mov word [ebp - 0x54], ax
push ecx
and ecx, 0x3329
and ecx, 0xa4af
pop ecx
push esi
or esi, 0x16e26
or esi, 0x118fd
pop esi
push edx
push eax
add esp, 4
call 0x40853b
add byte [ebx + 0x39], cl
cmp dword [eax], edi
push eax
inc esi
add esp, 4
pop edx
movzx ecx, word [ebp - 0x54]
test ecx, ecx
jne 0x40855c
movzx edx, word [ebp - 0x90]
movzx eax, word [ebp - 0x54]
inc ebp
lodsb al, byte [esi]
movzx ecx, word [ebp - 0x90]
movzx edx, word [ebp - 0x54]
cmp ecx, edx
je 0x408484
movzx eax, word [ebp - 0x90]
movzx ecx, word [ebp - 0x54]
cmp eax, ecx
jge 0x40858a
mov dword [ebp - 0x530], 0xffffffff
jmp 0x408594
mov dword [ebp - 0x530], 1
mov edx, dword [ebp - 0x530]
mov dword [ebp - 0x534], edx

Function at 0x408550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebp
lodsb al, byte [esi]
sub edx, eax
mov dword [ebp - 0x534], edx
jmp 0x4085a0
cmp dword [ebp - 0x534], 0
jne 0x4085e9
push edi
push esi
add esp, 4
call 0x4085bd
add byte [edi + 0x38], al
cmp dword [esi], edi
dec ebx
inc esp
dec edx
dec esi
inc ebx
add esp, 4
xor edi, 0xbd86
add edi, 0x12ee4
pop edi
push eax
add eax, 0x155d7
sub eax, 0x49e
pop eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1b8], eax
jmp 0x408651
push esi
xor esi, 0x1a99
pop esi
push edi
push ecx
add esp, 4
add edi, 0x17e32
jmp 0x408602
call fcn.00408611
add byte [edi + 0x35], al
dec edx
inc ecx
cmp dword [ebx + 0x3f], eax
cmp byte [ebp - 0x7d], al
add esp, 4
sub edi, 0x111d3
pop edi
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x30c]
je 0x408647
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + 0x30], 0
jne 0x408428
mov dword [ebp - 0x1b8], 0

Function at 0x4085bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebp
lodsb al, byte [esi]
sub edx, eax
mov dword [ebp - 0x534], edx
jmp 0x4085a0
cmp dword [ebp - 0x534], 0
jne 0x4085e9
push edi
push esi
add esp, 4
call 0x4085bd
add byte [edi + 0x38], al
cmp dword [esi], edi
dec ebx
inc esp
dec edx
dec esi
inc ebx
add esp, 4
xor edi, 0xbd86
add edi, 0x12ee4
pop edi
push eax
add eax, 0x155d7
sub eax, 0x49e
pop eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1b8], eax
jmp 0x408651
push esi
xor esi, 0x1a99
pop esi
push edi
push ecx
add esp, 4
add edi, 0x17e32
jmp 0x408602
call fcn.00408611
add byte [edi + 0x35], al
dec edx
inc ecx
cmp dword [ebx + 0x3f], eax
cmp byte [ebp - 0x7d], al
add esp, 4
sub edi, 0x111d3
pop edi
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x30c]
je 0x408647
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + 0x30], 0
jne 0x408428
mov dword [ebp - 0x1b8], 0
Function at 0x408611
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ebp
lodsb al, byte [esi]
sub edx, eax
mov dword [ebp - 0x534], edx
jmp 0x4085a0
cmp dword [ebp - 0x534], 0
jne 0x4085e9
push edi
push esi
add esp, 4
call 0x4085bd
add byte [edi + 0x38], al
cmp dword [esi], edi
dec ebx
inc esp
dec edx
dec esi
inc ebx
add esp, 4
xor edi, 0xbd86
add edi, 0x12ee4
pop edi
push eax
add eax, 0x155d7
sub eax, 0x49e
pop eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1b8], eax
jmp 0x408651
push esi
xor esi, 0x1a99
pop esi
push edi
push ecx
add esp, 4
add edi, 0x17e32
jmp 0x408602
call fcn.00408611
add byte [edi + 0x35], al
dec edx
inc ecx
cmp dword [ebx + 0x3f], eax
cmp byte [ebp - 0x7d], al
add esp, 4
sub edi, 0x111d3
pop edi
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x30c]
je 0x408647
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + 0x30], 0
jne 0x408428
mov dword [ebp - 0x1b8], 0

Function at 0x4086a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4086ac
add byte [esi], dh
dec eax
xor edi, dword [esi]
xor eax, dword [edx - 0x7d]
les eax, [ecx + eax*4]
out 0x32, al
fild word [eax]
add byte [ecx + 0x14e08ce], al
add byte [esi + 0x51], bl
call 0x4086c9
add byte [ebp + 0x44], cl
cmp eax, 0x83394033
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x1b8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x1c8], 0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x538], ecx
cmp dword [ebp - 0x538], 0
jne 0x40870c
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
jne 0x408734
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x53c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
inc dword [eax]
jne 0x408766
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], ecx
jmp 0x4089d2
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0x540]
mov dword [ebp - 0x1bc], edx
jne 0x40878b
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], eax
jmp 0x4089d2
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0xc0]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x724], edx
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0xc0]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c0], 0
jmp 0x4087e5
Function at 0x4086ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4086ac
add byte [esi], dh
dec eax
xor edi, dword [esi]
xor eax, dword [edx - 0x7d]
les eax, [ecx + eax*4]
out 0x32, al
fild word [eax]
add byte [ecx + 0x14e08ce], al
add byte [esi + 0x51], bl
call 0x4086c9
add byte [ebp + 0x44], cl
cmp eax, 0x83394033
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x1b8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x1c8], 0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x538], ecx
cmp dword [ebp - 0x538], 0
jne 0x40870c
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
jne 0x408734
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x53c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
inc dword [eax]
jne 0x408766
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], ecx
jmp 0x4089d2
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0x540]
mov dword [ebp - 0x1bc], edx
jne 0x40878b
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], eax
jmp 0x4089d2
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0xc0]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x724], edx
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0xc0]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c0], 0
jmp 0x4087e5
Function at 0x4086c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x4086ac
add byte [esi], dh
dec eax
xor edi, dword [esi]
xor eax, dword [edx - 0x7d]
les eax, [ecx + eax*4]
out 0x32, al
fild word [eax]
add byte [ecx + 0x14e08ce], al
add byte [esi + 0x51], bl
call 0x4086c9
add byte [ebp + 0x44], cl
cmp eax, 0x83394033
les eax, [ecx + ebx*2]
mov edx, dword [ebp - 0x1b8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x1c8], 0
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x538], ecx
cmp dword [ebp - 0x538], 0
jne 0x40870c
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
jne 0x408734
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], edx
jmp 0x4089d2
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x53c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
inc dword [eax]
jne 0x408766
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], ecx
jmp 0x4089d2
mov edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0x540]
mov dword [ebp - 0x1bc], edx
jne 0x40878b
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xe8], eax
jmp 0x4089d2
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0xc0]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x724], edx
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x1bc]
mov eax, dword [ebp - 0xc0]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c0], 0
jmp 0x4087e5

Function at 0x408de1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ebx - 0x107efb3c]
les ebx, [ecx]
add dword [eax], eax
xor edi, 0x87f
pop edi
mov dword [ebp - 0x1d8], 0
mov edx, dword [ebp - 0xc4]
mov dword [ebp - 0x404], edx
cmp dword [ebp - 0x404], 0
jne 0x408e21
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x10c], eax
jmp 0x4090e7
mov ecx, dword [ebp - 0x404]
mov edx, dword [ebp - 0xc4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x408], edx
jne 0x408e49
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x10c], eax
jmp 0x4090e7
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x408]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x40c], ecx
cmp dword [ebp - 0x40c], 0
jne 0x408e7b
mov edx, dword [ebp - 0x1d8]
mov dword [ebp - 0x10c], edx
jmp 0x4090e7
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x40c]
mov dword [ebp - 0x1cc], eax
jne 0x408ea0
invalid

Function at 0x4093b0
Capabilities:
Encode data using xor

Disassembly:
or al, dl
mov cs, word [ecx + 0xa080806]
or dword [ecx], ecx
or dword [esi + ecx*4 - 0x77], esi
push es
or byte [eax], cl
outsb dx, byte [esi]
push cs
xor esi, dword [eax - 4]
and dword [esi + edx*4 - 0x77], esi
push es
or byte [eax], cl
outsb dx, byte [esi]
xor al, 0xca
invalid
Function at 0x40c5e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 5
test eax, eax
je 0x40c70b
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40c70b
push ebx
push 1
push eax
call fcn.004110e0
push 1
push esi
mov edi, eax
call fcn.004110e0
add esp, 0x10
mov ebx, eax
jmp 0x40c630
push 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40c648
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40c64a
xor esi, esi
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x40c660
xor eax, eax
cmp dword [ebp + eax*4 - 0xc], esi
je 0x40c6be
inc eax
cmp eax, 2
jb 0x40c654
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
push ebx
call edi
add esp, 8
pop ebx
test esi, esi
je 0x40c710
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40c6d2
cmp dword [ebp - 4], edi
jb 0x40c6d2
push esi
push esi
call fcn.00417db0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 4
push eax
push ecx
push edx
push edi
push str.File_RenameRetry
push str.FILE:__s:_Retry_time_expired___u___s___s___last_error__s___d__n
call fcn.00412850
add esp, 0x1c
push esi
push str.File_RenameRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x64
push 0xa
call fcn.0040d550
add esp, 8
add dword [ebp - 4], eax
jmp 0x40c630
push esi
push esi
call fcn.00417db0
mov ecx, dword [ebp + 8]
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push str.File_RenameRetry
push str.FILE:__s:_Non_retriable_error_encountered___s___s_:__s___d__n
call fcn.00412850
add esp, 0x18
push esi
push str.File_RenameRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, 0x1e7
push esi
push str.File_RenameRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 5
test eax, eax
jne 0x40c788
mov esi, 0x1e7
push esi
push str.FileDeletionRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 1
push eax
call fcn.004110e0
mov ebx, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], eax
lea ebx, [ebx]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40c7b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40c7ba
xor esi, esi
cmp edi, ebx
jae 0x40c7cc
xor eax, eax
cmp dword [ebp + eax*4 - 0xc], esi
je 0x40c809
inc eax
cmp eax, 2
jb 0x40c7c0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test esi, esi
je 0x40c83a
test ebx, ebx
je 0x40c819
cmp edi, ebx
jb 0x40c819
push esi
push esi
call fcn.00417db0
mov edx, dword [ebp + 8]
add esp, 4
push eax
push edx
push ebx
push str.FileDeletionRetry
push str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.00412850
add esp, 0x18
jmp 0x40c83a
push 0x64
push 0xa
call fcn.0040d550
add esp, 8
add edi, eax
jmp 0x40c7a0
push esi
push esi
call fcn.00417db0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
push str.FileDeletionRetry
push str.FILE:__s:_Non_retriable_error_encountered___s_:__s___d__n
call fcn.00412850
add esp, 0x14
pop ebx
push esi
push str.FileDeletionRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c850
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 5
test eax, eax
jne 0x40c88b
mov esi, 0x1e7
push esi
push str.FileCreateDirectoryRetry
call fcn.0040c340
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 1
push eax
call fcn.004110e0
push 4
mov edi, eax
push 0x445c4c
push edi
call dword [sym.imp.MSVCR90.dll_wcsncmp]
add esp, 0x14
test eax, eax
je 0x40c8f6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c8b0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x40c8f6
call dword [sym.imp.MSVCR90.dll__errno]
push 0xce
mov dword [eax], 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov esi, 0xce
push esi
push str.FileCreateDirectoryRetry
call fcn.0040c340
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
lea ebx, [ebx]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c917
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40c919
xor esi, esi
cmp dword [ebp - 4], ebx
jae 0x40c92c
xor eax, eax
cmp dword [ebp + eax*4 - 0xc], esi
je 0x40c967
inc eax
cmp eax, 2
jb 0x40c920
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test esi, esi
je 0x40c999
test ebx, ebx
je 0x40c978
cmp dword [ebp - 4], ebx
jb 0x40c978
push esi
push esi
call fcn.00417db0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
push ebx
push str.FileCreateDirectoryRetry
push str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.00412850
add esp, 0x18
jmp 0x40c999
push 0x64
push 0xa
call fcn.0040d550
add esp, 8
add dword [ebp - 4], eax
jmp 0x40c900
push esi
push esi
call fcn.00417db0
mov ecx, dword [ebp + 8]
add esp, 4
push eax
push ecx
push str.FileCreateDirectoryRetry
push str.FILE:__s:_Non_retriable_error_encountered___s_:__s___d__n
call fcn.00412850
add esp, 0x14
pop ebx
pop edi
push esi
push str.FileCreateDirectoryRetry
call fcn.0040c340
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c9b0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 5
test eax, eax
jne 0x40c9e8
mov esi, 0x1e7
push esi
push str.FileRemoveDirectoryRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 1
push eax
call fcn.004110e0
mov ebx, dword [ebp + 0xc]
add esp, 8
mov dword [ebp - 4], eax
lea ebx, [ebx]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40ca18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40ca1a
xor esi, esi
cmp edi, ebx
jae 0x40ca2c
xor eax, eax
cmp dword [ebp + eax*4 - 0xc], esi
je 0x40ca69
inc eax
cmp eax, 2
jb 0x40ca20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test esi, esi
je 0x40ca9a
test ebx, ebx
je 0x40ca79
cmp edi, ebx
jb 0x40ca79
push esi
push esi
call fcn.00417db0
mov edx, dword [ebp + 8]
add esp, 4
push eax
push edx
push ebx
push str.FileRemoveDirectoryRetry
push str.FILE:__s:_Retry_time_expired___u___s___last_error__s___d__n
call fcn.00412850
add esp, 0x18
jmp 0x40ca9a
push 0x64
push 0xa
call fcn.0040d550
add esp, 8
add edi, eax
jmp 0x40ca00
push esi
push esi
call fcn.00417db0
add esp, 4
push eax
mov eax, dword [ebp + 8]
push eax
push str.FileRemoveDirectoryRetry
push str.FILE:__s:_Non_retriable_error_encountered___s_:__s___d__n
call fcn.00412850
add esp, 0x14
pop ebx
push esi
push str.FileRemoveDirectoryRetry
call fcn.0040c340
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d5d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
push edi
xor edi, edi
test ecx, ecx
je 0x40d5e0
mov dword [ecx], edi
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d6c0
push ebx
push esi
jmp 0x40d5f3
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40d5fc
mov esi, dword [ebp + 8]
jmp 0x40d617
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
dec eax
push eax
push edx
push str._s__d_s
push 0
call fcn.0040fcd0
add esp, 0x14
mov esi, eax
test edi, edi
jne 0x40d654
push edi
push 1
push esi
call fcn.0040c750
add esp, 0xc
test eax, eax
je 0x40d632
sub eax, 2
neg eax
sbb eax, eax
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40d68b
call fcn.00417f30
push eax
push esi
push str.FileRotateByRename
push str.FILE:__s:_failed_to_remove__s:__s_n
call fcn.00412850
add esp, 0x10
jmp 0x40d68b
push edi
push esi
call fcn.00406c10
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x40d68b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40d68b
push eax
call fcn.00417db0
push eax
push str.FileRotateByRename
push edi
push esi
push 0x44dc4c
call fcn.00412850
add esp, 0x18
cmp esi, dword [ebp + 8]
jne 0x40d6a8
cmp dword [ebp + 0x14], 0
je 0x40d6a8
test ebx, ebx
jne 0x40d6a8
push edi
call int.0040a6d0
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ecx], eax
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
sub dword [ebp - 4], 1
mov edi, esi
jns 0x40d5f0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40fcf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
call esi
add eax, 0x40
push eax
push str.Panic:
call dword [sym.imp.MSVCR90.dll_fputs]
mov ecx, dword [ebp + 8]
add esp, 8
lea eax, [ebp + 0xc]
push eax
push ecx
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_vfprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR90.dll_exit]
int3
Function at 0x410160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], 0
mov ebx, esi
cmp esi, 0x80000000
jb 0x41018f
push 0x2a7
push str.boralib_file_fileIOWin32.c
push str.VERIFY__s:_d_n
call fcn.0040fcf0
test esi, esi
jbe 0x4101b7
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4101c9
mov eax, dword [ebp - 4]
add edi, eax
sub esi, eax
jne 0x410196
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4101c0
mov dword [eax], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4101d7
sub ebx, esi
add ebx, dword [ebp - 4]
mov dword [eax], ebx
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4101f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], 0
mov ebx, esi
cmp esi, 0x80000000
jb 0x41021f
push 0x2de
push str.boralib_file_fileIOWin32.c
push str.VERIFY__s:_d_n
call fcn.0040fcf0
test esi, esi
jbe 0x41024b
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41025d
mov eax, dword [ebp - 4]
test eax, eax
je 0x410277
add edi, eax
sub esi, eax
jne 0x410226
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x410254
mov dword [eax], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x41026b
sub ebx, esi
add ebx, dword [ebp - 4]
mov dword [eax], ebx
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x410282
sub ebx, esi
mov dword [eax], ebx
pop edi
pop esi
mov eax, 5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x41038c
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 2
pop ebp
ret
push ebx
push esi
push 1
push eax
call fcn.004110e0
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
cmp ebx, 0xffffffff
jne 0x4103bc
pop esi
mov eax, 2
pop ebx
pop ebp
ret
test bl, 0x10
jne 0x4103d0
test bl, 1
je 0x4103d0
mov eax, 2
test byte [ebp + 0xc], al
jne 0x4103d2
xor eax, eax
pop esi
pop ebx
pop ebp
ret