joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b540
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46ae66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x498]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41b5c6
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41b628
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41b628
mov esi, dword [esp + 0x4a4]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0x7d1
call fcn.0043d0c0
jmp 0x41b65b
mov esi, dword [esp + 0x4a4]
lea edx, [esp + 8]
push esi
push edx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0x7d0
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41b6d7
cmp edi, 0xffffffff
jne 0x41b6d7
lea eax, [esp + 0x298]
push ebp
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x29c]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10c]
push ecx
push edx
mov dword [esp + 0x18], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x10c]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.0041a7a0
push eax
push str.Filename
mov ecx, esi
call dword [ebp + 0x28]
pop ebp
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41b720
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46ae86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41b7a6
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41b805
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41b805
mov esi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0x1e15
call fcn.0043d0c0
jmp 0x41b835
mov esi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push esi
push edx
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0x1e14
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41b899
cmp edi, 0xffffffff
jne 0x41b899
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41b8e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46aea6
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
mov ebx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x114]
mov dword [ebx], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00419e50
test eax, eax
jne 0x41b946
mov ecx, dword [esp + 0x120]
test ecx, ecx
je 0x41b93f
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x10]
xor al, al
jmp 0x41ba03
lea ecx, [esp + 0xc]
call fcn.00419d20
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x110], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.0041abb0
lea ecx, [esp + 0x6c]
call fcn.004472d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x10c], 1
call fcn.0041a2a0
test al, al
jne 0x41b9b5
lea ecx, [esp + 0x6c]
call fcn.00447320
test al, al
jne 0x41b9b5
lea ecx, [esp + 0xc]
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x41b9d4
jmp 0x41b9cc
lea ecx, [esp + 0xc]
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x41b9d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov eax, dword [esi]
lea ecx, [esp + 0x6c]
cmp eax, 0xffffffff
mov byte [esp + 0x10c], 0
setne bl
call fcn.00447310
lea ecx, [esp + 0xc]
mov dword [esp + 0x10c], 0xffffffff
call fcn.00419de0
mov al, bl
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret
Function at 0x41ba20
Capabilities:
Get common file path
Get session user name

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46aec6
push eax
mov dword fs:[0], esp
sub esp, 0x484
push esi
mov esi, dword [esp + 0x498]
mov ecx, esi
call fcn.00419e50
test eax, eax
jne 0x41ba7c
mov ecx, dword [esp + 0x49c]
test ecx, ecx
je 0x41ba63
mov eax, dword [ecx]
push str.Cannot_open_file__filename_is_empty.
call dword [eax + 0x10]
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push edi
lea ecx, [esp + 0x10]
call fcn.00419d20
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x498], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.0041abb0
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41bb08
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41bb08
mov esi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 0x80
push 3
push 0
push 3
push bind
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0x1771
call fcn.0043d0c0
jmp 0x41bb3b
mov esi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push esi
push edx
push 0
push 0x80
push 3
push 0
push 3
push bind
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0xbb9
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41bb9f
cmp edi, 0xffffffff
jne 0x41bb9f
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41bbe0
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46aee6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41bc66
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41bcc8
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41bcc8
mov esi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 0x2000000
push 3
push 0
push 1
push bind
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0xbb9
call fcn.0043d0c0
jmp 0x41bcfb
mov esi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push esi
push edx
push 0
push 0x2000000
push 3
push 0
push 1
push bind
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0xbba
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41bd5f
cmp edi, 0xffffffff
jne 0x41bd5f
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41bda0
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46af06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41be26
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41be88
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41be88
mov esi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 0x2000000
push 3
push 0
push 5
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0xbb9
call fcn.0043d0c0
jmp 0x41bebb
mov esi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push esi
push edx
push 0
push 0x2000000
push 3
push 0
push 5
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0xbbb
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41bf1f
cmp edi, 0xffffffff
jne 0x41bf1f
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41bf60
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46af26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41bfe6
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41c048
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41c048
mov esi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push esi
push ecx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0xfa1
call fcn.0043d0c0
jmp 0x41c07b
mov esi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push esi
push edx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0xfa0
call fcn.0043cf60
add esp, 0x28
mov edi, eax
test esi, esi
je 0x41c0df
cmp edi, 0xffffffff
jne 0x41c0df
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, esi
call dword [eax + 0x28]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41c120
Capabilities:
Get common file path
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x46af46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
lea ecx, [esp + 8]
call fcn.00419d20
mov eax, dword [esp + 0x494]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x490], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0041abb0
lea ecx, [esp + 8]
call fcn.00419e50
test eax, eax
jne 0x41c1a6
lea ecx, [esp + 8]
mov dword [esp + 0x48c], 0xffffffff
call fcn.00419de0
or eax, 0xffffffff
mov ecx, dword [esp + 0x484]
mov dword fs:[0], ecx
add esp, 0x490
ret
push esi
push edi
lea ecx, [esp + 0x70]
call fcn.004472d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x494], 1
call fcn.0041a2a0
test al, al
jne 0x41c208
lea ecx, [esp + 0x70]
call fcn.00447320
test al, al
jne 0x41c208
mov edi, dword [esp + 0x4a0]
lea ecx, [esp + 8]
push edi
push ecx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a130
push eax
push 0xfa1
call fcn.0043d0c0
jmp 0x41c23b
mov edi, dword [esp + 0x4a0]
lea edx, [esp + 8]
push edi
push edx
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [esp + 0x30]
call fcn.0041a4b0
push eax
push 0xfa0
call fcn.0043cf60
add esp, 0x28
mov esi, eax
test edi, edi
je 0x41c2a1
cmp esi, 0xffffffff
jne 0x41c2a6
lea eax, [esp + 0x298]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [edi]
lea eax, [esp + 0x298]
push eax
push str.CurrentDir
mov ecx, edi
call dword [edx + 0x28]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x14], 0x190
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [edi]
lea ecx, [esp + 0x108]
push ecx
push str.LoggedOnUser
mov ecx, edi
call dword [eax + 0x28]
jmp 0x41c2b3
cmp esi, 0xffffffff
je 0x41c2b3
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x70]
mov byte [esp + 0x494], 0
call fcn.00447310
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x490
ret
Function at 0x41c300
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x46af71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
push edi
lea ecx, [esp + 0x28]
call fcn.00419d20
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x12c], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 0x30]
call fcn.0041abb0
lea ecx, [esp + 0x88]
call fcn.004472d0
mov bl, 1
lea ecx, [esp + 0x88]
mov byte [esp + 0x128], bl
call fcn.00447320
test al, al
push 0
lea ecx, [esp + 0x2c]
je 0x41c389
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x41c395
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x41c3ea
mov edi, dword [esp + 0x134]
test edi, edi
je 0x41c3e8
push ebp
lea ecx, [esp + 0x10]
call fcn.00416ed0
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 2
call fcn.00418200
mov ebp, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00422700
push eax
push str.errorMsg
mov ecx, edi
call dword [ebp + 0x28]
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], bl
call fcn.004171c0
pop ebp
test esi, esi
lea ecx, [esp + 0x88]
mov byte [esp + 0x128], 0
setne bl
call fcn.00447310
lea ecx, [esp + 0x28]
mov dword [esp + 0x128], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0x120]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x120
ret

Function at 0x41c430
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x46af96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
lea ecx, [esp]
call fcn.00419d20
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push eax
mov dword [esp + 0x104], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 8]
call fcn.0041abb0
lea ecx, [esp + 0x60]
call fcn.004472d0
lea ecx, [esp + 0x60]
mov byte [esp + 0x100], 1
call fcn.00447320
test al, al
lea ecx, [esp]
je 0x41c4ad
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x41c4b9
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
push ebx
lea ecx, [esp + 0x64]
setne bl
mov byte [esp + 0x104], 0
call fcn.00447310
lea ecx, [esp + 4]
mov dword [esp + 0x104], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0xfc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret
Function at 0x41c500
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x46afb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
lea ecx, [esp]
call fcn.00419d20
mov eax, dword [esp + 0x108]
lea ecx, [esp]
push eax
mov dword [esp + 0x104], 0
call fcn.0041a9d0
push 0x5c
push 0x2f
lea ecx, [esp + 8]
call fcn.0041abb0
lea ecx, [esp + 0x60]
call fcn.004472d0
lea ecx, [esp + 0x60]
mov byte [esp + 0x100], 1
call fcn.00447320
test al, al
je 0x41c585
mov ecx, dword [esp + 0x10c]
push ecx
lea ecx, [esp + 4]
call fcn.0041a4b0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41c59d
mov edx, dword [esp + 0x10c]
lea ecx, [esp]
push edx
call fcn.0041a130
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
push ebx
lea ecx, [esp + 0x64]
setne bl
mov byte [esp + 0x104], 0
call fcn.00447310
lea ecx, [esp + 4]
mov dword [esp + 0x104], 0xffffffff
call fcn.00419de0
mov ecx, dword [esp + 0xfc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret

Function at 0x41c5e0
Capabilities:
Access peb ldr_data
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x46afc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x30]
lea eax, [esp]
push edi
xor edi, edi
push eax
push ecx
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x41c678
push esi
mov esi, dword [esp + 0x3c]
cmp esi, edi
je 0x41c661
lea ecx, [esp + 0xc]
call fcn.00416ed0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
call fcn.00418200
mov edi, dword [esi]
lea ecx, [esp + 0xc]
call fcn.00422700
push eax
mov ecx, esi
call dword [edi + 0x10]
mov edx, dword [esi]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004171c0
or eax, 0xffffffff
pop esi
or edx, 0xffffffff
pop edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 4]
push ecx
push eax
call fcn.00440c80
mov ecx, dword [esp + 0x2c]
add esp, 8
mov dword fs:[0], ecx
pop edi
add esp, 0x2c
ret
Function at 0x41c6a0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46aff3
push eax
mov eax, dword [esp + 0x18]
mov dword fs:[0], esp
sub esp, 0x80
mov byte [eax], 0
push ebx
mov ebx, dword [esp + 0x94]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
jne 0x41c6da
xor eax, eax
jmp 0x41c847
cmp byte [ebx], 0
jne 0x41c6e6
xor eax, eax
jmp 0x41c847
lea ecx, [esp + 0x30]
call fcn.00419d20
push ebx
lea ecx, [esp + 0x34]
mov dword [esp + 0x9c], ebp
call fcn.00419f30
push 0x5c
push 0x2f
lea ecx, [esp + 0x38]
call fcn.0041abb0
mov esi, dword [esp + 0xa4]
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.0041ba20
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x41c740
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], eax
call fcn.00419de0
xor eax, eax
jmp 0x41c847
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x41c7d3
test esi, esi
je 0x41c7b0
lea ecx, [esp + 0x14]
call fcn.00416ed0
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 1
call fcn.00418200
mov ebp, dword [esi]
lea ecx, [esp + 0x14]
call fcn.00422700
push eax
mov ecx, esi
call dword [ebp + 0x10]
mov eax, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
push str.Failed_to_get_file_size__ANSI_
mov ecx, esi
call dword [edx + 0x10]
lea ecx, [esp + 0x14]
mov byte [esp + 0x98], 0
call fcn.004171c0
push 0
push edi
call fcn.0043cf40
add esp, 8
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00419de0
xor eax, eax
jmp 0x41c847
push 0
push edi
call fcn.0043cf40
mov eax, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x41c827
test esi, esi
je 0x41c80f
mov eax, dword [esi]
push str.File_too_large_for_32_bits
mov ecx, esi
call dword [eax + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esi]
push str.Failed_to_get_file_size.
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x98], 0xffffffff
call fcn.00419de0
xor eax, eax
jmp 0x41c847
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x98], 0xffffffff
mov byte [ecx], 1
lea ecx, [esp + 0x30]
call fcn.00419de0
mov eax, ebp
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret