joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a61b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a6414
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a6217
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a5c7c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d984
cmp al, 1
jne 0x4a6217
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a5f94
test al, al
je 0x4a63a3
cmp dword [ebp - 8], 0
jge 0x4a6235
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a5c7c
mov eax, dword [ebp - 0x210]
call fcn.004047fc
cmp ebx, eax
jge 0x4a627f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a5c7c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4ecd74]
and eax, 0xff
bt dword [edx], eax
jae 0x4a627f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a6293
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a6190
cmp ebx, dword [ebp - 8]
je 0x4a6395
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a62bf
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004038f0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eb69c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a6382
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004038f0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eb69c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046a7a0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004038f0
and eax, 0x7f
movzx eax, word [eax*2 + 0x4eb69c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046a7a0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6389
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a63f6
cmp dword [ebp - 8], 0
jge 0x4a63ae
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a5c7c
mov eax, dword [ebp - 0x218]
call fcn.004047fc
cmp eax, dword [ebp - 8]
jg 0x4a63e8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a5c7c
mov eax, dword [ebp - 0x21c]
call fcn.004047fc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a6190
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a641b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404560
ret
Function at 0x4b1713
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4ec24e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b176b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4ec26f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b1761
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4b176f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4c3634
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4c7bb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef0
mov ebx, eax
push esp
push 0x20019
push 0
push 0x4c7c84
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c7c7a
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4c7ca8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c7c71
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004047ac
mov edx, dword [ebx]
mov eax, 0x4c7cb8
call fcn.00404b40
test eax, eax
jle 0x4c7c45
push ebx
mov edx, dword [ebx]
mov eax, 0x4c7cb8
call fcn.00404b40
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404a5c
mov eax, dword [ebx]
call fcn.004047fc
cmp eax, 2
jle 0x4c7c71
mov eax, dword [ebx]
call fcn.004047fc
mov edx, eax
mov eax, dword [ebx]
call fcn.0040dc44
test al, al
jne 0x4c7c71
mov eax, ebx
mov edx, 0x4c7cc4
call fcn.00404804
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop ebx
ret

Function at 0x4e799c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.00409a2c
add esp, 0x100
pop ebx
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401099
jmp 0x401040
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm1, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm0, mm1
punpckhwd mm5, mm6
paddd mm4, mm4
paddd mm3, mm5
paddd mm3, mm4
movq qword [edi - 0x10], mm0
add esi, 8
sub eax, 4
movq qword [edi - 8], mm3
jge 0x401040
add eax, 4
jle 0x4010ce
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add edx, edx
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x40109f
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x5ae196
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx + 0x75], 0x9a
push cs
invalid
sahf
into
push cs
xor byte [eax - 0x49e67682], dl
dec ecx
salc
ja 0x5ae11c
or eax, dword [ebx + 0x62a24213]
and al, 0x47
in al, dx
lea ebp, [eax - 0x1b407d39]
fistp dword [edi]
xchg byte [eax + ebp*4 - 0x39], al
pop edi
dec ecx
imul edi, ebx, 0x5e1b8a1f
jo 0x5ae184
popal
mov bl, 0xa7
push cs
imul edi, ebp, 0xf9631f8b
pop ds
cmp eax, edx
outsb dx, byte [esi]
sub al, 0x31
mov word [0x49ca6c67], gs
xor dword [edi], 0x428b8fe0
invalid

Function at 0x5aebf6
Capabilities:
Encode data using xor

Disassembly:
call 0x473ed09d
and ecx, ebp
inc ebx
in al, dx
pushal
dec ecx
xchg ecx, eax
push edi
insb byte es:[edi], dx
adc eax, 0x9366ef2c
inc ecx
insb byte es:[edi], dx
cmc
push ebx
xchg dword [esi + 0x2d], ecx
rcr byte [ebp - 0x58], 0x6c
sub cl, ah
ror dword [esi - 0x17], cl
pop edi
mov dl, 0x3e
xor dword [esi], eax
add al, 0x8b
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
push ebp
cmp eax, 0x416b99a4
fld qword [edi]
das
inc esi
inc edx
add al, 0x87
dec esp
xor al, 0xe0
mov byte [0x610e5cc5], al
out 0x7d, al
pop ss
mov dword [edi + 0x270dc7fa], esi
mov ecx, 0x764eef03
push 0xffffffffffffff87
call 0x10956c3d
jp 0x5aec11
cmp bh, al
dec ebx
inc esp
mov ah, 0x50
setne byte [edx]
mov ebx, 0x98755cfc
cmp eax, 0x4b5a7fbe
push edx
sbb eax, 0xff2d26fb
and al, 0xb7
jg 0x5aec58
mov dh, 0x68
xchg ebx, eax
scasb al, byte es:[edi]
retf
Function at 0x64f9b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x64fa49
jmp 0x64f9f0
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm1, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm0, mm1
punpckhwd mm5, mm6
paddd mm4, mm4
paddd mm3, mm5
paddd mm3, mm4
movq qword [edi - 0x10], mm0
add esi, 8
sub eax, 4
movq qword [edi - 8], mm3
jge 0x64f9f0
add eax, 4
jle 0x64fa7e
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add edx, edx
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x64fa4f
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret
Function at 0x416830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41684a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416840
mov eax, 1
add ebx, ebx
jne 0x416863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416858
jne 0x416874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416858
xor ecx, ecx
sub eax, 3
jb 0x416888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4168fa
mov ebp, eax
add ebx, ebx
jne 0x416893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4168a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4168c4
inc ecx
add ebx, ebx
jne 0x4168b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4168a5
jne 0x4168c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4168a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4168e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4168d5
jmp 0x416846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4168e4
add edi, ecx
jmp 0x416846
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41694c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x169f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416901
mov ecx, edi
jns 0x416930
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a7c]
or eax, eax
je 0x416946
mov dword [ebx], eax
add ebx, 4
jmp 0x41691e
call dword [esi + 0x16a78]
mov ebp, dword [esi + 0x16a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416980
sub esp, 0xffffff80
jmp 0x404843

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x409fe0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44ddab
push eax
mov eax, 0x18a0
mov dword fs:[0], esp
call fcn.00429440
lea ecx, [esp]
call fcn.004252d0
lea ecx, [esp]
mov dword [esp + 0x18a8], 0
call fcn.00425320
test al, al
je 0x40a049
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00408da0
jmp 0x40a09d
lea edx, [esp + 0x89c]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40a089
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00408da0
jmp 0x40a09d
mov ecx, dword [esp + 0x18b0]
lea edx, [esp + 0x89c]
push edx
call fcn.00408fa0
lea ecx, [esp]
mov dword [esp + 0x18a8], 0xffffffff
call fcn.00425310
mov ecx, dword [esp + 0x18a0]
mov dword fs:[0], ecx
add esp, 0x18ac
ret

Function at 0x40a0d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44ddcb
push eax
mov eax, 0x20a4
mov dword fs:[0], esp
call fcn.00429440
lea ecx, [esp]
call fcn.004252d0
lea ecx, [esp]
mov dword [esp + 0x20ac], 0
call fcn.00425320
test al, al
je 0x40a139
lea eax, [esp + 0x89c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x89c]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00408da0
jmp 0x40a198
lea edx, [esp + 0x10a0]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40a184
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40a16e
mov byte [esp + 0x98], al
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00408da0
jmp 0x40a198
mov ecx, dword [esp + 0x20b4]
lea edx, [esp + 0x10a0]
push edx
call fcn.00408fa0
lea ecx, [esp]
mov dword [esp + 0x20ac], 0xffffffff
call fcn.00425310
mov ecx, dword [esp + 0x20a4]
mov dword fs:[0], ecx
add esp, 0x20b0
ret
Function at 0x40a3d0
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44de4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408bb0
mov eax, dword [esp + 0x248]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x244], 0
call fcn.00409a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.00409d00
lea ecx, [esp + 0x118]
call fcn.004252d0
lea ecx, [esp + 0x118]
mov byte [esp + 0x240], 1
call fcn.00425320
test al, al
lea ecx, [esp + 8]
je 0x40a45d
call fcn.004093b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x40a52a
call fcn.00408cf0
cmp eax, 0x104
jle 0x40a56b
lea ecx, [esp + 0x1b0]
call fcn.00408bb0
lea ecx, [esp + 0x1b0]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x248], 2
call fcn.00409ed0
add esp, 8
lea ecx, [esp + 0x90]
call fcn.00408bb0
push 0x45c874
lea ecx, [esp + 0x94]
mov byte [esp + 0x244], 3
call fcn.00409700
lea ecx, [esp + 0x1b0]
call fcn.004097d0
push eax
lea ecx, [esp + 0x94]
call fcn.00409700
lea ecx, [esp + 0x90]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x40a4ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40a4fd
mov esi, 1
test esi, esi
lea ecx, [esp + 0x90]
mov byte [esp + 0x240], 2
setne bl
call fcn.00408c80
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x240], 1
call fcn.00408c80
lea ecx, [esp + 0x118]
mov byte [esp + 0x240], 0
call fcn.00425310
lea ecx, [esp + 8]
mov dword [esp + 0x240], 0xffffffff
call fcn.00408c80
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
add esp, 0x23c
ret
push edi
lea ecx, [esp + 0xc]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x40a5c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x250]
mov ebx, eax
test esi, esi
je 0x40a5b5
push ebp
push ebx
mov ecx, esi
call fcn.00425480
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.004097d0
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call dword [ebp + 0x28]
pop ebp
cmp ebx, 2
jne 0x40a5bf
mov edi, 1
test edi, edi
lea ecx, [esp + 0x11c]
mov byte [esp + 0x244], 0
setne bl
call fcn.00425310
lea ecx, [esp + 0xc]
mov dword [esp + 0x244], 0xffffffff
call fcn.00408c80
mov ecx, dword [esp + 0x23c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x23c
ret
Function at 0x40ad10
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44ded1
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebp
mov ebp, dword [esp + 0x1c4]
push esi
mov esi, dword [esp + 0x1c4]
push edi
mov edi, dword [esp + 0x1c4]
mov dword [ebp], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00408cf0
test eax, eax
jne 0x40ad77
mov ecx, dword [esp + 0x1d0]
test ecx, ecx
je 0x40ad70
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x10]
xor al, al
jmp 0x40aeab
push ebx
lea ecx, [esp + 0x10]
call fcn.00408bb0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c4], 0
call fcn.00409a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.00409d00
lea ecx, [esp + 0x10]
call fcn.00408cf0
lea ecx, [esp + 0x120]
mov edi, eax
call fcn.004252d0
mov bl, 1
cmp edi, 0x104
mov byte [esp + 0x1c0], bl
jge 0x40ae03
lea ecx, [esp + 0x10]
call fcn.004091a0
test al, al
jne 0x40ade8
lea ecx, [esp + 0x120]
call fcn.00425320
test al, al
je 0x40ae03
lea ecx, [esp + 0x10]
call fcn.004093b0
push eax
call fcn.0040ca40
add esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40ae7a
jmp 0x40ae71
test edi, edi
jle 0x40ae5a
lea ecx, [esp + 0x98]
call fcn.00408bb0
lea ecx, [esp + 0x98]
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x1c8], 2
call fcn.0040a2c0
add esp, 8
lea ecx, [esp + 0x98]
call fcn.00409030
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x98]
mov dword [esi], eax
mov byte [esp + 0x1c0], bl
call fcn.00408c80
jmp 0x40ae6c
lea ecx, [esp + 0x10]
call fcn.00409030
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x40ae7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x120]
mov byte [esp + 0x1c0], 0
setne bl
call fcn.00425310
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00408c80
mov al, bl
pop ebx
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1b4
ret
Function at 0x40b350
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44df6c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d0
push ebx
push esi
push edi
lea ecx, [esp + 0x34]
call fcn.00408bb0
mov eax, dword [esp + 0x1ec]
lea ecx, [esp + 0x34]
push eax
mov dword [esp + 0x1e8], 0
call fcn.00409a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x3c]
call fcn.00409d00
lea ecx, [esp + 0x144]
call fcn.004252d0
mov bl, 1
lea ecx, [esp + 0x144]
mov byte [esp + 0x1e4], bl
call fcn.00425320
test al, al
je 0x40b3db
push 0
lea ecx, [esp + 0x38]
call fcn.004093b0
push eax
call fcn.0040ca00
add esp, 8
jmp 0x40b44f
lea ecx, [esp + 0x34]
call fcn.00408cf0
test eax, eax
jle 0x40b43d
lea ecx, [esp + 0xbc]
call fcn.00408bb0
lea ecx, [esp + 0xbc]
lea edx, [esp + 0x34]
push ecx
push edx
mov byte [esp + 0x1ec], 2
call fcn.0040a2c0
add esp, 8
lea ecx, [esp + 0xbc]
push 0
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0xbc]
mov esi, eax
mov byte [esp + 0x1e4], bl
call fcn.00408c80
jmp 0x40b451
push 0
lea ecx, [esp + 0x38]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x40b4a4
mov edi, dword [esp + 0x1f0]
test edi, edi
je 0x40b4a2
push ebp
lea ecx, [esp + 0x10]
call fcn.00406110
lea ecx, [esp + 0x10]
mov byte [esp + 0x1e8], 3
call fcn.00406d00
mov ebp, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00446f00
push eax
push str.errorMsg
mov ecx, edi
call dword [ebp + 0x28]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1e8], bl
call fcn.00406400
pop ebp
test esi, esi
lea ecx, [esp + 0x144]
mov byte [esp + 0x1e4], 0
setne bl
call fcn.00425310
lea ecx, [esp + 0x34]
mov dword [esp + 0x1e4], 0xffffffff
call fcn.00408c80
mov ecx, dword [esp + 0x1dc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1dc
ret
Function at 0x40b4f0
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x44dfa1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408bb0
mov eax, dword [esp + 0x1c0]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x1bc], 0
call fcn.00409a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.00409d00
lea ecx, [esp + 0x118]
call fcn.004252d0
mov bl, 1
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], bl
call fcn.00425320
test al, al
lea ecx, [esp + 8]
je 0x40b576
call fcn.004093b0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40b5e2
call fcn.00408cf0
test eax, eax
jle 0x40b5d2
lea ecx, [esp + 0x90]
call fcn.00408bb0
lea ecx, [esp + 0x90]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x1c0], 2
call fcn.0040a2c0
add esp, 8
lea ecx, [esp + 0x90]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x90]
mov esi, eax
mov byte [esp + 0x1b8], bl
call fcn.00408c80
jmp 0x40b5e4
lea ecx, [esp + 8]
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], 0
setne bl
call fcn.00425310
lea ecx, [esp + 8]
mov dword [esp + 0x1b8], 0xffffffff
call fcn.00408c80
mov ecx, dword [esp + 0x1b0]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret

Function at 0x40b630
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44dfd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00408bb0
mov eax, dword [esp + 0x1c0]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x1bc], 0
call fcn.00409a00
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.00409d00
lea ecx, [esp + 8]
push 0
push ecx
call fcn.0040a610
add esp, 8
lea ecx, [esp + 0x118]
call fcn.004252d0
mov bl, 1
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], bl
call fcn.00425320
test al, al
je 0x40b6d7
mov edx, dword [esp + 0x1c4]
lea ecx, [esp + 8]
push edx
call fcn.004093b0
push eax
call fcn.0040ca20
add esp, 8
and eax, 0xff
jmp 0x40b757
lea ecx, [esp + 8]
call fcn.00408cf0
test eax, eax
jle 0x40b73f
lea ecx, [esp + 0x90]
call fcn.00408bb0
lea eax, [esp + 0x90]
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x1c0], 2
call fcn.0040a2c0
mov edx, dword [esp + 0x1cc]
add esp, 8
lea ecx, [esp + 0x90]
push edx
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x90]
mov esi, eax
mov byte [esp + 0x1b8], bl
call fcn.00408c80
jmp 0x40b759
mov eax, dword [esp + 0x1c4]
lea ecx, [esp + 8]
push eax
call fcn.00409020
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x118]
mov byte [esp + 0x1b8], 0
setne bl
call fcn.00425310
lea ecx, [esp + 8]
mov dword [esp + 0x1b8], 0xffffffff
call fcn.00408c80
mov ecx, dword [esp + 0x1b0]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret