joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b94ae
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x78ebd8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x104]
push esi
push edi
mov esi, 0x80
mov dword [ebp - 0x908], ebx
push esi
push 0
push eax
call fcn.005077d5
push esi
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.005077d5
mov edi, dword [ebx]
mov dword [ebp - 0x90c], edi
mov ebx, dword [edi + 0x150]
mov eax, dword [ebx + 0x1eb4]
sub eax, dword [ebx + 0x1eb0]
add eax, 2
push eax
lea eax, [ebx + 0x1cb0]
push eax
push 0x3c
push edi
call fcn.005b8b46
mov eax, dword [ebx + 0x1eb0]
add esp, 0x28
movzx ecx, byte [eax]
inc eax
mov dword [ebx + 0x1eb0], eax
cmp ecx, 0x18
je 0x5b967a
cmp ecx, 0x23
je 0x5b9659
cmp ecx, 0x27
jne 0x5b9703
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.0059c483
mov ebx, dword [ebx + 0x1cac]
add esp, 0x1c
push 4
pop esi
test ebx, ebx
je 0x5b95f3
push dword [ebx]
call fcn.006909d0
pop ecx
lea edi, [eax + 1]
add edi, esi
cmp edi, 0x7fa
jae 0x5b95e6
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push dword [ebx]
call fcn.00420e1b
add esp, 0x10
test eax, eax
je 0x5b95e6
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, esi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.0059c483
add esp, 0x1c
mov esi, edi
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x5b957e
mov edi, dword [ebp - 0x90c]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, esi
push str._c_c
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.0059c483
add esp, 0x14
lea eax, [esi + 2]
push 0
push eax
lea eax, [ebp - 0x904]
push eax
mov eax, dword [ebp - 0x908]
push dword [eax + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x5b9653
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0059b8d5
add esp, 0xc
push esi
jmp 0x5b96f1
lea esi, [ebx + 0x1c28]
push esi
call fcn.006909d0
push 0xf0
lea ebx, [eax + 6]
mov eax, 0xff
push eax
push esi
push 0
push 0x23
jmp 0x5b9699
lea esi, [ebx + 0x1c08]
push esi
call fcn.006909d0
push 0xf0
lea ebx, [eax + 6]
mov eax, 0xff
push eax
push esi
push 0
push 0x18
push 0xfa
push eax
push str._c_c_c_c_s_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.0059c483
add esp, 0x2c
lea eax, [ebp - 0x904]
push 0
push ebx
push eax
mov eax, dword [ebp - 0x908]
push dword [eax + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x5b96ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0059b8d5
add esp, 0xc
lea eax, [ebx - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push edi
call fcn.005b8b46
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0068a492
mov esp, ebp
pop ebp
ret
Function at 0x5ba1e4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x78ebd8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x508]
mov edi, dword [eax]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
lea ebx, [esi + 0x15c]
push 0
add eax, 4
push eax
push dword [ebx]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x5ba277
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.0068bfa0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x5ba2a9
push str.Received_too_short_packet
push edi
call fcn.0059b8d5
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0068a492
mov esp, ebp
pop ebp
ret
push ebx
call fcn.005b9eab
movzx eax, ax
mov dword [esi + 0xc], eax
pop ecx
sub eax, 3
je 0x5ba322
sub eax, 1
je 0x5ba394
sub eax, 1
je 0x5ba300
sub eax, 1
je 0x5ba2e3
push str.Internal_error:_Unexpected_packet
push 0x6ed168
push edi
call fcn.0059b8d5
jmp 0x5ba391
lea eax, [edx - 2]
push eax
mov eax, dword [ebx]
add eax, 2
push eax
push esi
call fcn.005ba005
add esp, 0xc
test eax, eax
je 0x5ba394
jmp 0x5ba298
push ebx
call fcn.005b9e92
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebx]
add eax, 4
push eax
push 0x73ef54
push edi
call fcn.0059b99f
add esp, 0x10
jmp 0x5ba394
cmp edx, 4
jle 0x5ba394
push ebx
call fcn.005b9e92
pop ecx
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne 0x5ba394
lea eax, [edx - 4]
push eax
mov eax, dword [ebx]
add eax, 4
push eax
push 1
push dword [ebp - 0x8c]
call fcn.0059b7e9
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x5ba369
push 5
push esi
call fcn.005baa32
pop ecx
pop ecx
mov eax, ebx
jmp 0x5ba298
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x90], eax
adc dword [edi + 0x94], edx
push dword [edi + 0x94]
push dword [edi + 0x90]
push edi
call fcn.005b2363
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.005b272f
pop ecx
test eax, eax
je 0x5ba296
push 5
push esi
call fcn.005baa32
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x5ba298
Function at 0x5ba3ba
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 3
pop esi
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x5ba4fa
dec eax
sub eax, 1
je 0x5ba4b8
sub eax, 1
je 0x5ba464
sub eax, 1
je 0x5ba404
push str.tftp_rx:_internal_error
push 0x6ed168
push ebx
call fcn.0059b8d5
add esp, 0xc
push 0x47
jmp 0x5ba595
inc dword [edi + 0x18]
movzx eax, word [edi + 0x40]
push dword [edi + 0x18]
inc eax
movzx eax, ax
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.0059b99f
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x5ba437
mov dword [edi + 8], 0xffffff9d
mov dword [edi], esi
jmp 0x5ba5ce
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x5ba5ce
jmp 0x5ba575
xor eax, eax
lea esi, [edi + 0x160]
and dword [edi + 0x18], eax
push 4
push esi
mov word [edi + 0x40], ax
call fcn.005b9edf
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005b9ec3
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x5ba575
mov dword [edi], 1
jmp 0x5ba5b2
lea esi, [edi + 0x160]
push 5
push esi
call fcn.005b9edf
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005b9ec3
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
push 3
pop eax
mov dword [edi], eax
jmp 0x5ba5ce
lea eax, [edi + 0x15c]
push eax
call fcn.005b9e92
pop ecx
movzx ecx, word [edi + 0x40]
movzx esi, ax
lea eax, [ecx + 1]
movzx eax, ax
cmp eax, esi
jne 0x5ba51e
and dword [edi + 0x18], 0
jmp 0x5ba535
cmp ecx, esi
jne 0x5ba5be
push esi
push str.Received_last_DATA_packet_block__d_again._n
push ebx
call fcn.0059b99f
add esp, 0xc
mov word [edi + 0x40], si
lea esi, [edi + 0x160]
push 4
push esi
call fcn.005b9edf
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.005b9ec3
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x5ba598
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.005aaf73
push eax
push 0x6ed168
push ebx
call fcn.0059b8d5
add esp, 0x14
push 0x37
pop eax
jmp 0x5ba5d0
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
inc ecx
cmp dword [edi + 0x14c], eax
push 3
pop eax
cmovl ecx, eax
mov dword [edi], ecx
lea eax, [edi + 0x38]
push eax
call fcn.0069c80e
pop ecx
jmp 0x5ba5ce
push eax
push esi
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.0059b99f
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5bf4a9
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x78ebd8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push esi
push edi
push ecx
mov eax, dword [ebx + 0x1ac]
lea ecx, [ebp - 0x84]
mov edi, dword [ebx]
or esi, 0xffffffff
push ecx
push eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5bf51c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push ebx
call fcn.005a8d08
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x5bf541
push str.Error_accept__ing_server_connect
push edi
call fcn.0059b8d5
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x5bf5a9
push str.Connection_accepted_from_server_n
push edi
call fcn.0059b99f
push 1
mov byte [ebx + 0x284], 0
push esi
mov dword [ebx + 0x1ac], esi
call fcn.005c5a7a
add esp, 0x10
mov byte [ebx + 0x1b9], 1
cmp dword [edi + 0x1d8], 0
je 0x5bf5a7
push 1
push edi
call fcn.0059d9e1
push 1
push esi
push dword [edi + 0x1dc]
call dword [edi + 0x1d8]
push 0
push edi
mov esi, eax
call fcn.0059d9e1
add esp, 0x1c
test esi, esi
je 0x5bf5a7
push ebx
call fcn.005bf972
pop ecx
push 0x2a
jmp 0x5bf53e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0068a492
mov esp, ebp
pop ebp
ret

Function at 0x5c14ed
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [ecx - 0xc8]
mov edx, dword [edi]
cmp eax, 0x64
jb 0x5c1519
push str.Couldnt_set_desired_mode
push edx
call fcn.0059b8d5
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x5c156a
cmp ecx, 0xc8
je 0x5c1530
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push edx
call fcn.0059b99f
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x5c1540
push edi
call fcn.005c1290
jmp 0x5c1565
cmp eax, 0x14
jne 0x5c154d
push edi
call fcn.005c04bf
jmp 0x5c1565
cmp eax, 0x15
jne 0x5c155a
push edi
call fcn.005c127c
jmp 0x5c1565
cmp eax, 0x16
jne 0x5c1568
push edi
call fcn.005c13f8
mov esi, eax
pop ecx
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x5cc049
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x78c070]
mov edi, eax
pop ecx
test edi, edi
je 0x5cc135
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5cc0b2
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x5cc0b8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
xor ebx, ebx
pop ecx
pop ecx
test eax, eax
je 0x5cc12d
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
sub ebx, 1
jne 0x5cc0d2
mov ebx, dword [ebp - 8]
jmp 0x5cc12d
push 1
push 0x6f1557
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x6f1558
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x5cc10f
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5cd4c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dc1ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x78ebd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x78c0e0]
cmp eax, 0xffffffff
jne 0x5cd4f6
xor ebx, ebx
jmp 0x5cd4ff
push eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x5cd541
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x5cd580
test esi, esi
jne 0x5cd584
push 0x5cce20
push 0x79ea1c
call fcn.005cca90
mov eax, dword [0x78c0e0]
add esp, 8
cmp eax, 0xffffffff
je 0x5cd541
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x5cd56e
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x5cd56e
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x5cd5c6
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x5cd5af
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x5cd584
cmp dword [ebx + 0x18], 0
je 0x5cd510
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x5cd5ed
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5cd5ed
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.004af161
cmp dword [ebx + 0x18], 0
jne 0x5cd5d0
jmp 0x5cd510

Function at 0x5cd610
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x5cd670
push 0
push 0
call fcn.00694f05
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x5cd639
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x5cd657
cmp eax, 0xffffffff
je 0x5cd657
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x5ced90
Capabilities:
Create directory

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x5cedaf
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0040fadb
mov dword [edi + 8], eax
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test eax, eax
je 0x5ceddb
cmp dword [esi + 0x14], 8
jb 0x5cedc5
mov ecx, dword [esi]
jmp 0x5cedc7
mov ecx, esi
cmp dword [eax + 0x14], 8
jb 0x5cedcf
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryExW]
jmp 0x5cedf0
cmp dword [esi + 0x14], 8
jb 0x5cede5
mov eax, dword [esi]
jmp 0x5cede7
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x5cedfc
pop edi
mov al, 1
pop esi
add esp, 0x14
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
call fcn.0040fadb
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.005cffb0
add esp, 0xc
cmp dword [esp + 0xc], 3
je 0x5cee45
push str.boost::filesystem::create_directory
push edi
push esi
push ebx
call fcn.005d46a0
add esp, 0x10
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x14
ret

Function at 0x5cee50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dc4b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x78ebd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, eax
mov edx, 2
test edi, edi
mov eax, 1
cmove edi, eax
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0068a1e7
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
push esi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x5ceee4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x5ceee4
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.005d47b0
add esp, 0xc
jmp 0x5ceefd
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x5ceefd
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0040fadb
mov dword [edi + 8], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [esi], ax
je 0x5cef2f
mov eax, esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5cef20
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.004abd80
push esi
call fcn.0068a1e2
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5cf770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x5cf783
mov eax, dword [esi]
jmp 0x5cf785
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5cf7ad
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.005cf600
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5cf7c8
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.0040fadb
mov dword [edi + 8], eax
pop edi
test ebx, 0x400
je 0x5cf7ff
push esi
call fcn.005cf200
add esp, 4
test al, al
je 0x5cf7f4
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x5cfde0
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x5cfdec
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x5cfe2a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x5cfe2a
cmp eax, 3
je 0x5cfe2a
cmp eax, 0x7b
je 0x5cfe2a
cmp eax, 0xf
je 0x5cfe2a
cmp eax, 0x15
je 0x5cfe2a
cmp eax, 0x57
je 0x5cfe2a
cmp eax, 0xa1
je 0x5cfe2a
cmp eax, 0x35
je 0x5cfe2a
xor al, al
ret
mov al, 1
ret

Function at 0x5cfe30
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x5cfe3c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x5cfe7a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x5cfe7a
cmp eax, 3
je 0x5cfe7a
cmp eax, 0x7b
je 0x5cfe7a
cmp eax, 0xf
je 0x5cfe7a
cmp eax, 0x15
je 0x5cfe7a
cmp eax, 0x57
je 0x5cfe7a
cmp eax, 0xa1
je 0x5cfe7a
cmp eax, 0x35
je 0x5cfe7a
xor al, al
ret
mov al, 1
ret

Function at 0x5cff40
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x5cff50
mov eax, dword [esi]
jmp 0x5cff52
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x5cff60
mov ecx, dword [edi]
jmp 0x5cff62
mov ecx, edi
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
test eax, eax
jne 0x5cff91
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x5cff91
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.005d4580
add esp, 0x14
pop edi
pop esi
ret
mov esi, dword [esp + 0x14]
test esi, esi
je 0x5cffab
mov dword [esi], 0
mov byte [esi + 4], 0
call fcn.0040fadb
mov dword [esi + 8], eax
pop edi
pop esi
ret
Function at 0x5cffb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6dc6b2
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x78ebd8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x6c], esi
test esi, esi
je 0x5cfffd
mov dword [esi], 0
mov byte [esi + 4], 0
call fcn.0040fadb
mov dword [esi + 8], eax
cmp dword [ebx + 0x14], 8
jb 0x5d0007
mov eax, dword [ebx]
jmp 0x5d0009
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x5d0028
push esi
push ebx
push edi
call fcn.005cf600
add esp, 0xc
jmp 0x5d012a
push eax
push ebx
call fcn.005cf4d0
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], esi
test eax, 0x400
je 0x5d0108
push ebx
call fcn.005cf200
add esp, 4
test al, al
jne 0x5d0060
mov dword [edi], 9
mov dword [edi + 4], esi
jmp 0x5d012a
cmp dword [ebx + 0x14], 8
jb 0x5d006a
mov eax, dword [ebx]
jmp 0x5d006c
mov eax, ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.00426118
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [ebp - 0x60], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004231b3
cmp esi, 0xffffffff
jne 0x5d00c2
push dword [ebp - 0x6c]
push ebx
push edi
call fcn.005cf600
add esp, 0xc
jmp 0x5d012a
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
test eax, eax
jne 0x5d00ee
push dword [ebp - 0x6c]
push ebx
push edi
call fcn.005cf600
add esp, 0xc
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x5d012a
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x64]
mov dword [ebp - 0x64], esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 3
test al, 0x10
jne 0x5d0120
mov dword [ebp - 0x68], 2
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0068a492
mov esp, ebp
pop ebp
ret