joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b520
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
jne 0x46b537
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov ebp, dword [esp + 0x14]
push 0
push eax
push ebx
push ebp
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46b5df
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x46b58e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x46b572
cmp eax, 3
jne 0x46b58e
cmp ebx, 0x4e20
jbe 0x46b58e
push 0x4e20
push ebp
mov ecx, esi
call fcn.0046b520
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 1
jne 0x46b5a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x46b5a8
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 0
jne 0x46b5d5
cmp ebx, 0x8000
jbe 0x46b5d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x46b5d5
push 0x8000
push ebp
mov ecx, esi
call fcn.0046b520
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x46b720
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1014
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1010], eax
mov edx, dword [esp + 0x1018]
push ebx
mov ebx, dword [esp + 0x1020]
push ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp byte [edi + 0x1d], 0
mov dword [edi + 0x1020], 0
jne 0x46b768
test bl, 4
jne 0x46b768
xor cl, cl
jmp 0x46b76a
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x46b78f
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x46b79e
or ebx, 2
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
cmp byte [edi + 0x1c], 0
mov dword [esp + 0x18], eax
je 0x46b7bc
or esi, 0x100
push 0
push eax
push 3
push 0
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x46b832
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0x800
push eax
push dword [esp + 0x1c]
call fcn.0047cf30
test al, al
je 0x46b821
push 0
push dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x46b81c
mov dword [esp + 0x10], eax
cmp ebp, 0xffffffff
jne 0x46b832
cmp dword [esp + 0x10], 2
jne 0x46b832
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x46b85e
cmp ebp, 0xffffffff
je 0x46b85e
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebp, 0xffffffff
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
setne bl
mov byte [edi + 0x10], 0
cmp ebp, 0xffffffff
je 0x46b88d
push 0x800
push dword [esp + 0x14]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.004947d0
mov ecx, dword [esp + 0x101c]
mov al, bl
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x1014
ret 8
Function at 0x46bda0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x46bdb9
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 8
cmp dword [ebp + 0xc], 1
jne 0x46bdca
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp + 4], eax
push esi
push edi
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0
je 0x46be34
xor esi, esi
test ebx, ebx
je 0x46be57
jmp 0x46bdf0
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x46be00
mov eax, 0x4000
push 0
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x34]
add eax, esi
push eax
push dword [ebp + 4]
call ecx
cmp eax, 1
sete al
mov byte [esp + 0x2c], al
test al, al
je 0x46be57
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 0x4000
cmp esi, ebx
jb 0x46bdf0
jmp 0x46be4f
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push dword [esp + 0x34]
push dword [ebp + 4]
call ecx
cmp eax, 1
sete al
mov byte [esp + 0x2c], al
test al, al
jne 0x46bf44
cmp byte [ebp + 0x14], 0
je 0x46bf44
cmp dword [ebp + 0xc], 0
jne 0x46bf44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebp
mov eax, dword [ebp]
mov eax, dword [eax + 0x14]
call eax
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x1e]
push eax
mov dword [esp + 0x20], edx
call fcn.0046cc10
push edi
mov dword [esp + 0x18], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x46bee7
ja 0x46bea9
cmp dword [esp + 0x14], ebx
jbe 0x46bee7
mov esi, dword [esp + 0x18]
mov edx, esi
mov edi, dword [esp + 0x1c]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x46bee7
jl 0x46bec4
cmp edx, 0xffffffff
ja 0x46bee7
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x20], ecx
js 0x46bee7
jg 0x46bed7
cmp eax, 0xffffffff
jbe 0x46bee7
lea esi, [ebp + 0x1e]
mov ecx, 0x57f41c
push esi
call fcn.00466b80
jmp 0x46beea
lea esi, [ebp + 0x1e]
push 0
push esi
mov ecx, 0x57f41c
call fcn.00466510
test al, al
je 0x46bf34
mov eax, dword [esp + 0x10]
mov ecx, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jae 0x46bdd2
test eax, eax
je 0x46bdd2
mov esi, dword [ebp]
mov ecx, ebp
push 0
mov eax, dword [esi + 0x14]
call eax
sub eax, dword [esp + 0x14]
mov ecx, ebp
sbb edx, 0
push edx
push eax
call dword [esi + 0x10]
jmp 0x46bdcc
lea edx, [ebp + 0x1e]
mov ecx, 0x57f41c
push edx
push 0
call fcn.00466b40
mov al, byte [esp + 0x2c]
pop edi
pop esi
mov byte [ebp + 8], 1
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x46c070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513868
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x544354]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0
jbe 0x46c0e3
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov eax, 0x54
mov word [ebp - 0x20], ax
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
test ecx, ecx
je 0x46c10c
cmp byte [esi + 0x10], 0
je 0x46c102
mov eax, dword [esi + 8]
add eax, eax
push eax
push ecx
call fcn.00491e00
push dword [esi]
call fcn.004fe8b9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46c650
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x46c6a7
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0047cf30
test al, al
je 0x46c6a7
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x46c6a9
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4

Function at 0x46c6d0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x46c727
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0047cf30
test al, al
je 0x46c727
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x46c729
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4
Function at 0x46c820
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513941
mov eax, dword fs:[0]
push eax
mov eax, 0x71a0
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.0047d170
test al, al
je 0x46caab
push esi
call fcn.0046cfd0
test al, al
je 0x46caab
movzx eax, word [esi]
push eax
push 0x525cdc
lea eax, [ebp - 0x2010]
push 0x800
push eax
call fcn.00402720
movzx eax, word [ebp - 0x2010]
add esp, 0x10
push eax
push 0x85
call fcn.0046bf60
lea ecx, [ebp - 0x2070]
call fcn.00494820
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2070]
call fcn.004948c0
push 2
push 0
push 2
lea eax, [ebp - 0x2070]
push eax
lea ecx, [ebp - 0x71ac]
call fcn.00490a40
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30b8]
push eax
lea ecx, [ebp - 0x71ac]
mov dword [ebp - 0x20a8], 0
mov dword [ebp - 0x20a4], 0
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
mov dword [ebp - 0x2098], 0
mov dword [ebp - 0x2094], 0
call fcn.00491710
test eax, eax
jne 0x46ca64
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x46c950
mov ax, word [ebp - 0x30b8]
cmp ax, word [esi]
jne 0x46ca64
cmp word [ebp - 0x30b6], 0x3a
jne 0x46ca64
push 0
lea eax, [ebp - 0x30b8]
push eax
call edi
test eax, eax
setne al
test al, al
jne 0x46c9a9
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.0047cf30
test al, al
je 0x46c9a9
push 0
lea eax, [ebp - 0x1010]
push eax
call edi
cmp byte [ebp - 0x20ac], 0
lea eax, [ebp - 0x30b8]
push eax
je 0x46c9ef
call ebx
test eax, eax
setne al
test al, al
jne 0x46ca4a
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.0047cf30
test al, al
je 0x46ca4a
lea eax, [ebp - 0x1010]
push eax
call ebx
jmp 0x46ca4a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
jne 0x46ca4a
push 0x800
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x30b8]
push eax
call fcn.0047cf30
test al, al
je 0x46ca30
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
jne 0x46ca4a
lea eax, [ebp - 0x30b8]
push eax
push 0
push 0xe
call fcn.00403f00
mov ecx, 0x57f41c
call fcn.00466a60
lea eax, [ebp - 0x30b8]
push eax
lea ecx, [ebp - 0x71ac]
call fcn.00491710
test eax, eax
je 0x46c950
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x71ac]
call fcn.00490b30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2070]
test ecx, ecx
je 0x46caab
cmp byte [ebp - 0x2060], 0
je 0x46caa2
mov eax, dword [ebp - 0x2068]
add eax, eax
push eax
push ecx
call fcn.00491e00
mov ecx, dword [ebp - 0x2070]
push ecx
call fcn.004fe8b9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f833c
mov esp, ebp
pop ebp
ret 4
Function at 0x46cad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46cb23
push 0x800
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.0047cf30
test al, al
je 0x46cb20
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
mov ecx, dword [esp + 0x1008]
setne al
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4

Function at 0x46cb40
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
cmp dword [ecx + 0x14], 0
jbe 0x46cb95
xor eax, eax
mov dword [ecx + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov eax, 0x54
mov word [esp + 0x10], ax
mov eax, dword [ecx]
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret

Function at 0x46cba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
push edi
mov edi, dword [esp + 0x1010]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46cbf2
push 0x800
lea eax, [esp + 0xc]
push eax
push edi
call fcn.0047cf30
test al, al
je 0x46cbf0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x46cbf2
mov eax, esi
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4

Function at 0x46cc10
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
lea ecx, [esp + 0x18]
push 0x800
push ecx
push eax
call fcn.0047cc00
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 8]
push eax
movzx eax, word [esp + 0x24]
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x46cca1
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
ja 0x46cca1
xor eax, eax
add eax, dword [esp]
adc edx, 0
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004f833c
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x1018]
xor eax, eax
xor ecx, esp
xor edx, edx
call fcn.004f833c
add esp, 0x101c
ret 4
Function at 0x46ce90
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
lea ecx, [esp + 0x20c]
push 0x800
push ecx
push eax
call fcn.0047cc90
push 0x105
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x46cf94
mov ecx, 0x525cc8
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46cf1a
test dx, dx
je 0x46cf16
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46cf1a
add eax, 4
add ecx, 4
test dx, dx
jne 0x46cef4
xor eax, eax
jmp 0x46cf1f
sbb eax, eax
or eax, 1
test eax, eax
je 0x46cf78
mov ecx, str.FAT32
lea eax, [esp]
jmp 0x46cf30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46cf56
test dx, dx
je 0x46cf52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46cf56
add eax, 4
add ecx, 4
test dx, dx
jne 0x46cf30
xor eax, eax
jmp 0x46cf5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x46cf78
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004f833c
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004f833c
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor al, al
xor ecx, esp
call fcn.004f833c
add esp, 0x1210
ret 4

Function at 0x46cfd0
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
lea ecx, [esp]
push 0x800
push ecx
push eax
call fcn.0047cc90
movzx eax, word [esp]
lea ecx, [esp]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x46d035
cmp eax, 5
je 0x46d035
xor al, al
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
mov al, 1
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4
Function at 0x46d060
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push esi
call fcn.0047d800
movzx eax, word [eax]
cmp eax, 0x2e
je 0x46d0a0
cmp eax, 0x20
je 0x46d0a0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46d0f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d126
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.0047cf30
test al, al
je 0x46d0d0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d126
push 0x800
lea eax, [esp + 8]
push eax
push esi
call fcn.0047cf30
test al, al
je 0x46d126
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46d126
cmp byte [esp + 0x1010], 0
je 0x46d10c
push dword [esp + 0x1014]
push esi
call fcn.0046d6f0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x46d13b
cmp eax, 3
mov eax, 1
jne 0x46d140
mov eax, 2
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 0xc
Function at 0x46d160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x107c
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1078], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1090]
mov esi, edi
lea ecx, [esi + 2]
jmp 0x46d190
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x46d190
sub esi, ecx
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x1c]
sar esi, 1
mov dword [esp + 0x20], 0
call fcn.00495df0
lea ecx, [esp + 0x1c]
call fcn.00495c50
push 0
push 0x186a0
push edx
push eax
call fcn.004f87e0
mov ebp, eax
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x10], eax
mov ecx, ebp
mov eax, 0x4f8b588f
xor ebx, ebx
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xf
mov dword [esp + 0x14], eax
imul eax, eax, 0xc350
sub ecx, eax
lea eax, [esp + 0x24]
push ecx
push dword [esp + 0x14]
push str._u._03u
push 0x32
push eax
call fcn.00402720
lea ecx, [esp + 0x38]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d221
mov ebp, dword [esp + 0x1094]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
cmp eax, ebp
jae 0x46d2e9
cmp ebx, 0x3e8
je 0x46d2e9
mov eax, ebp
sub eax, esi
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [edi + esi*2]
push eax
call fcn.004947d0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46d29b
push 0x800
lea eax, [esp + 0x8c]
push eax
push edi
call fcn.0047cf30
test al, al
je 0x46d306
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46d306
imul eax, dword [esp + 0x14], 0xc350
inc ebx
mov ecx, ebx
sub ecx, eax
lea eax, [esp + 0x24]
add ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x14]
push str._u._03u
push 0x32
push eax
call fcn.00402720
lea eax, [esp + 0x38]
add esp, 0x14
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46d2d0
sub eax, edx
sar eax, 1
add eax, esi
cmp eax, ebp
jb 0x46d242
xor eax, eax
mov ecx, dword [esp + 0x1088]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x107c
ret 8
mov eax, edi
jmp 0x46d2eb

Function at 0x46d310
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
mov edi, dword [esp + 0x100c]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x46d35e
push 0x800
lea eax, [esp + 8]
push eax
push edi
call fcn.0047cf30
test al, al
je 0x46d35e
push 0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x1004]
pop edi
xor ecx, esp
call fcn.004f833c
add esp, 0x1004
ret 4
Function at 0x46d380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x106c
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1068], eax
mov eax, dword [esp + 0x1070]
push ebx
push ebp
mov ebp, dword [esp + 0x1080]
push esi
push edi
mov edi, dword [esp + 0x1084]
push ebp
push eax
push edi
mov dword [esp + 0x1c], eax
call fcn.004947d0
push 0x32
push str.temp
lea eax, [esp + 0x1c]
push eax
call fcn.004947d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
push 0x2e
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x3e8]
push 0
push eax
call fcn.004945c0
push ebp
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0047d930
push edi
call ebx
cmp eax, 0xffffffff
jne 0x46d41f
push 0x800
lea eax, [esp + 0x7c]
push eax
push edi
call fcn.0047cf30
test al, al
je 0x46d428
lea eax, [esp + 0x78]
push eax
call ebx
cmp eax, 0xffffffff
je 0x46d428
inc esi
cmp esi, 0x3e8
jb 0x46d3d6
push edi
push dword [esp + 0x14]
call fcn.0046d450
mov ecx, dword [esp + 0x1078]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x106c
ret 0xc

Function at 0x46d450
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x2014]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test bl, bl
jne 0x46d4cf
push 0x800
lea eax, [esp + 0x1010]
push eax
push edi
call fcn.0047cf30
test al, al
je 0x46d4cf
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0047cf30
test al, al
je 0x46d4cf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x46d4d1
mov al, bl
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2004
ret 8