joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x40f0a3
push 1
lea ecx, [ebp - 1]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x40f0b7
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
jb 0x40f0cc
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jle 0x40f0d5
mov dword [edi + 0x40], 0x66
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [esi]
push edi
test cl, cl
jne 0x40f513
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x40f493
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x40f4a4
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
je 0x40f4b5
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop edi
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x40f4c7
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x48]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x40f4e1
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x40f4f4
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call sub.MSVCR90.dll_fread
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x40f4a9
mov al, byte [edi]
mov edx, dword [ebp + 8]
dec cl
mov byte [edx], al
mov byte [edi], 2
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret
mov al, byte [esi + 1]
mov edi, dword [ebp + 8]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
mov byte [edi], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret
Function at 0x4105e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
cmp dword [0x7a6cec], 0
je 0x410641
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x7a4d88]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x7a4d8c]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
fild qword [esp + 8]
fdiv qword [0x7a4c10]
fstp dword [esp + 8]
fld dword [0x67a1c0]
fld dword [esp + 8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4106ad
fstp st(0)
lea eax, [esp + 8]
push eax
mov dword [0x7a6cec], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 8]
push 0x7a4d88
fstp qword [0x7a4c10]
call esi
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x7a4d88]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x7a4d8c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
fdiv qword [0x7a4c10]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [0x7a6cf0]
fst dword [0x7a6cf4]
fst dword [0x7a6cf8]
fst dword [0x7a6cfc]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4106c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x6e8794]
xor eax, esp
mov dword [esp + 0x130], eax
cmp byte [0x7a6cc8], 1
push ebx
push esi
push edi
push 0
jne 0x410820
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
je 0x41071c
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x410733
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, eax
je 0x4107ef
test esi, esi
je 0x4107ef
push esi
call ebx
push str.xxxxxxxx____xxx
push 0x67a114
push 0x128000
push 0x400000
push esi
call fcn.00410540
push str.x____xxxxx____xx
push 0x67a138
push 0x60000
push 0x900000
push esi
call fcn.00410540
push str.xxxxxxxxxxxxxxxxxx
push 0x67a160
push 0x10000
push 0x410000
push esi
call fcn.00410540
push str.xxx____xx____xx
push 0x67a184
push 0x10000
push 0x410000
push esi
mov edi, eax
call fcn.00410540
add esp, 0x50
test edi, edi
jne 0x4107db
test eax, eax
je 0x4107e4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x410739
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
call sub.MSVCR90.dll_exit
int3
Function at 0x411930
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5daa57
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e8794]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
je 0x411983
mov dword [ebp], 0x67a1b0
mov dword [ebp + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 4], ebx
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
call fcn.004103f0
lea esi, [ebp + 8]
push 0x20
mov ecx, edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.00412dc0
mov byte [edi + 0x30], al
cmp dword [edi + 0x28], ebx
jne 0x4119ce
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.00410280
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00412a90
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x7a8ce0]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x412a90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5d9cbb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6e8794]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.005c64f5
push 4
mov dword [esp + 0x24], 0
call fcn.005707f0
mov edi, eax
add esp, 4
test edi, edi
je 0x412b12
call fcn.005c62ff
mov dword [edi], eax
call fcn.005c612d
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.005c6051
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x412b07
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.005c6079
jmp 0x412b14
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x433d20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca327
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x6e8794]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.0042a9b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.0042a9b0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.0042cb40
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0042cb40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0042d470
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0042d470
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.00460540
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.004605c0
movzx edx, al
test edx, edx
je 0x433dfe
lea ecx, [ebp - 0x1bc]
call fcn.0042bdc0
push eax
lea ecx, [ebp - 0x134]
call fcn.0042bdc0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x433edc
lea ecx, [ebp - 0x134]
call fcn.0042ab40
test eax, eax
jg 0x433e20
lea ecx, [ebp - 0x1bc]
call fcn.0042ab40
test eax, eax
jle 0x433eb3
lea ecx, [ebp - 0x24c]
call fcn.0042a9b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.0042a9b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.00433f50
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00433f50
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.0042b450
push eax
lea ecx, [ebp - 0x24c]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.0042aac0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.0042aac0
jmp 0x433edc
lea ecx, [ebp - 0x1bc]
call fcn.0042b450
push eax
lea ecx, [ebp - 0x134]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x433ef5
cmp dword [ebp + 0x10], 0
je 0x433ef5
mov ecx, dword [ebp + 0x10]
call fcn.00448070
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.004605a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.0042aac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.0042aac0
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
Function at 0x434080
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca3ac
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6e8794]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.0042a9b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0042cb40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0042d470
lea ecx, [ebp - 0x134]
call fcn.00460540
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.004605c0
movzx ecx, al
test ecx, ecx
je 0x434148
lea ecx, [ebp - 0x94]
call fcn.0042bdc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042aac0
mov al, byte [ebp - 0x255]
jmp 0x43431b
lea ecx, [ebp - 0x94]
call fcn.0042ab40
cmp eax, 0x104
jle 0x43424e
lea ecx, [ebp - 0x1bc]
call fcn.0042a9b0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.004339b0
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.0042a9b0
mov byte [ebp - 4], 3
push 0x61c954
lea ecx, [ebp - 0x24c]
call fcn.0042c600
lea ecx, [ebp - 0x1bc]
call fcn.0042c820
push eax
lea ecx, [ebp - 0x24c]
call fcn.0042c600
lea ecx, [ebp - 0x24c]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x4341ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4341ef
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.0042aac0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.0042aac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042aac0
mov al, byte [ebp - 0x256]
jmp 0x43431b
lea ecx, [ebp - 0x94]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x4342c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x4342ae
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00448110
lea ecx, [ebp - 0x94]
call fcn.0042c820
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x4342c1
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042aac0
mov al, byte [ebp - 0x257]
jmp 0x43431b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
Function at 0x4352f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca561
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6e8794]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.0042ab40
test eax, eax
jne 0x43535b
cmp dword [ebp + 0x14], 0
je 0x435354
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x4354c4
lea ecx, [ebp - 0x94]
call fcn.0042a9b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0042cb40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0042d470
lea ecx, [ebp - 0x94]
call fcn.0042ab40
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.00460540
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x43540c
lea ecx, [ebp - 0x94]
call fcn.0042baa0
movzx ecx, al
test ecx, ecx
jne 0x4353db
lea ecx, [ebp - 0x134]
call fcn.004605c0
movzx edx, al
test edx, edx
je 0x43540c
lea ecx, [ebp - 0x94]
call fcn.0042bdc0
push eax
call fcn.00437160
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x435407
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x43548c
cmp dword [ebp - 0x138], 0
jle 0x435462
lea ecx, [ebp - 0x1c4]
call fcn.0042a9b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00433f50
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.0042b470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.0042aac0
jmp 0x435479
lea ecx, [ebp - 0x94]
call fcn.0042b470
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x43548c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042aac0
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
Function at 0x435880
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca50c
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x6e8794]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x13c]
call fcn.0042a9b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.0042cb40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x13c]
call fcn.0042d470
lea ecx, [ebp - 0xac]
call fcn.00460540
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xac]
call fcn.004605c0
movzx ecx, al
test ecx, ecx
je 0x435924
push 0
lea ecx, [ebp - 0x13c]
call fcn.0042bdc0
push eax
call fcn.00437120
add esp, 8
mov dword [ebp - 0xb0], eax
jmp 0x43599d
lea ecx, [ebp - 0x13c]
call fcn.0042ab40
test eax, eax
jle 0x435983
lea ecx, [ebp - 0x1c4]
call fcn.0042a9b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.00433f50
add esp, 8
push 0
lea ecx, [ebp - 0x1c4]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.0042aac0
jmp 0x43599d
push 0
lea ecx, [ebp - 0x13c]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x4359f3
cmp dword [ebp + 0xc], 0
je 0x4359f3
lea ecx, [ebp - 0x1ec]
call fcn.00430170
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ec]
call fcn.00433420
lea ecx, [ebp - 0x1ec]
call fcn.0042d6b0
push eax
push str.errorMsg
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
call fcn.00430540
cmp dword [ebp - 0xb0], 0
setne cl
mov byte [ebp - 0x1ed], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.0042aac0
mov al, byte [ebp - 0x1ed]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret
Function at 0x435a50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca561
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6e8794]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.0042a9b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0042cb40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0042d470
push 0
push 1
lea ecx, [ebp - 0x94]
push ecx
call fcn.00434340
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.00460540
mov byte [ebp - 4], 1
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x134]
call fcn.004605c0
movzx edx, al
test edx, edx
je 0x435b0f
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x94]
call fcn.0042bdc0
push eax
call fcn.00437140
add esp, 8
movzx ecx, al
mov dword [ebp - 0x138], ecx
jmp 0x435b8c
lea ecx, [ebp - 0x94]
call fcn.0042ab40
test eax, eax
jle 0x435b70
lea ecx, [ebp - 0x1c4]
call fcn.0042a9b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00433f50
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.0042aac0
jmp 0x435b8c
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x94]
call fcn.0042b450
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004605a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0042aac0
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005c4d04
mov esp, ebp
pop ebp
ret

Function at 0x437140
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
pop ebp
ret