joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46aaf0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0xa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
mov esi, dword [esp + 0xa8]
lea eax, [esp + 4]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x46ab57
push ebx
lea eax, [esp + 0x74]
push eax
push 0x10
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0xc]
cmp eax, 1
sete bl
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
pop ebx
jne 0x46ab63
push 0x10
lea eax, [esp + 0x74]
push eax
call fcn.0046abe0
push 0x10
lea eax, [esp + 0x74]
push eax
call fcn.0046abe0
lea eax, [esp + 8]
push eax
call fcn.0049bea0
push 0x10
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0049bef0
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.0049bd80
mov eax, dword [esp + 0xac]
cmp eax, 0x20
jb 0x46abad
mov eax, 0x20
push eax
lea eax, [esp + 0x84]
push eax
push esi
call fcn.00504fb0
mov ecx, dword [esp + 0xac]
add esp, 0xc
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0xa0
ret 8

Function at 0x46abe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
push edi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.0049e510
lea ecx, [esp + 8]
call fcn.0049e370
mov edi, eax
mov ebp, edx
call fcn.00509526
cdq
add edi, eax
adc ebp, edx
xor ecx, ecx
mov dword [esp + 8], ecx
cmp dword [esp + 0x18], ecx
jbe 0x46ac5e
push ebx
mov ebx, dword [0x58c1e4]
push esi
mov esi, dword [esp + 0x1c]
sub esi, ebx
nop
and ecx, 7
mov eax, edi
shl ecx, 3
mov edx, ebp
call fcn.005032d0
mov ecx, dword [esp + 0x10]
xor al, cl
add al, bl
inc ecx
mov byte [esi + ebx], al
inc ebx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x20]
jb 0x46ac30
pop esi
mov dword [0x58c1e4], ebx
pop ebx
pop edi
pop ebp
add esp, 8
ret 8

Function at 0x46ac70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
mov eax, edx
push ebx
mov ebx, dword [ecx + 0x10a8]
push ebp
mov ebp, dword [ecx + 0x10ac]
push esi
lea esi, [edx + 1]
mov dword [esp + 0xc], 4
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, edx
sub eax, esi
add eax, 2
sub edx, esi
mov dword [esp + 0x18], eax
push edi
mov edi, dword [ecx + 0x10a4]
lea eax, [edx + 3]
mov edx, dword [ecx + 0x10b0]
mov dword [esp + 0x20], eax
lea ebx, [ebx]
mov eax, dword [esp + 0x18]
lea esi, [esi + 4]
movzx eax, byte [eax + esi - 4]
xor edi, dword [ecx + eax*4 + 0xba4]
mov dword [ecx + 0x10a4], edi
movzx eax, byte [esi - 4]
xor ebx, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x10a8], ebx
movzx eax, byte [eax + esi - 4]
xor ebp, dword [ecx + eax*4 + 0xba4]
mov eax, dword [esp + 0x20]
mov dword [ecx + 0x10ac], ebp
movzx eax, byte [eax + esi - 4]
xor edx, dword [ecx + eax*4 + 0xba4]
sub dword [esp + 0x10], 1
mov dword [ecx + 0x10b0], edx
jne 0x46acc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x46afb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x19c
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1a8]
push ebx
mov ebx, dword [esp + 0x1b4]
push ebp
mov ebp, dword [esp + 0x1bc]
push esi
mov esi, dword [esp + 0x1b8]
mov dword [esp + 0x10], eax
mov eax, esi
push edi
mov edi, dword [esp + 0x1b0]
mov dword [esp + 0x18], edi
cmp esi, 0x40
jb 0x46b006
mov eax, 0x40
push eax
push ecx
lea eax, [esp + 0x14c]
push eax
call fcn.00504fb0
add esp, 0xc
cmp esi, 0x44
jae 0x46b21d
lea eax, [esi + 1]
mov byte [esp + esi + 0x144], 0
cmp eax, 0x44
jae 0x46b21d
mov byte [esp + eax + 0x144], 0
lea eax, [esi + 2]
cmp eax, 0x44
jae 0x46b21d
push 0
push 0
push 0
mov byte [esp + eax + 0x150], 0
lea eax, [esp + 0x130]
push 0
push eax
lea eax, [esi + 4]
mov byte [esp + esi + 0x15b], 1
push eax
lea eax, [esp + 0x15c]
push eax
push dword [esp + 0x1d0]
push edi
call fcn.0046ad30
mov eax, dword [esp + 0x1cc]
lea esi, [esp + 0x124]
dec eax
mov dword [esp + 0xfc], ebp
mov ecx, 8
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x14]
lea edi, [esp + 0x104]
xor ebp, ebp
mov dword [esp + 0xf0], 0x10
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xf4], 0x10
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x100], eax
mov byte [esp + 0x13], 0
mov byte [esp + 0x12], 0
mov dword [esp + 0x14], ebp
jmp 0x46b0f0
mov ebx, dword [esp + ebp + 0xec]
test ebx, ebx
je 0x46b1a1
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x198]
push eax
push 0x20
lea eax, [esp + 0x13c]
push eax
push dword [esp + 0x1d0]
push ebp
call fcn.0046ad30
mov ecx, 8
lea esi, [esp + 0x188]
lea edi, [esp + 0x124]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movzx ecx, byte [esp + eax + 0x124]
xor byte [esp + eax + 0x104], cl
movzx ecx, byte [esp + eax + 0x125]
xor byte [esp + eax + 0x105], cl
movzx ecx, byte [esp + eax + 0x126]
xor byte [esp + eax + 0x106], cl
movzx ecx, byte [esp + eax + 0x127]
xor byte [esp + eax + 0x107], cl
add eax, 4
cmp eax, 0x20
jb 0x46b150
sub ebx, 1
jne 0x46b103
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + ebp + 0xf8]
lea esi, [esp + 0x104]
add ebp, 4
mov ecx, 8
mov dword [esp + 0x14], ebp
rep movsd dword es:[edi], dword [esi]
cmp ebp, 0xc
jb 0x46b0f0
push 0x44
lea eax, [esp + 0x148]
push eax
call fcn.0049a3e0
push 0x20
lea eax, [esp + 0x108]
push eax
call fcn.0049a3e0
push 0x20
lea eax, [esp + 0x128]
push eax
call fcn.0049a3e0
push 0x20
lea eax, [esp + 0x18c]
push eax
call fcn.0049a3e0
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x19c
ret 0x20
call fcn.00502eb2
int3
Function at 0x46c000
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edi]
cmp eax, ecx
jbe 0x46c069
mov edx, 1
cmp ecx, edx
jb 0x46c042
mov ebp, dword [esp + 0x14]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
lea ebx, [ebx]
mov eax, dword [ebx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
cmp edx, dword [esi]
jbe 0x46c030
mov eax, dword [edi]
sub eax, dword [esi]
mov ebx, dword [esp + 0x14]
shl eax, 2
push eax
lea eax, [edi + edx*4]
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.00504fb0
mov eax, dword [edi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
jae 0x46c0ba
mov edx, 1
cmp eax, edx
jb 0x46c093
mov ebp, dword [esp + 0x14]
lea ecx, [esi + 4]
mov ebx, edi
sub ebx, esi
sub ebp, esi
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
inc edx
mov dword [ecx + ebp - 4], eax
cmp edx, dword [edi]
jbe 0x46c081
mov eax, dword [esi]
sub eax, dword [edi]
mov ebx, dword [esp + 0x14]
shl eax, 2
push eax
lea eax, [esi + edx*4]
push eax
lea eax, [ebx + edx*4]
push eax
call fcn.00504fb0
mov eax, dword [esi]
add esp, 0xc
mov dword [ebx], eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
test eax, eax
je 0x46c0d4
mov ebx, edi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + ebx]
cmp ecx, dword [edx]
jne 0x46c0d4
sub edx, 4
sub eax, 1
jne 0x46c0c5
mov ebx, dword [esp + 0x14]
mov dword [ebx], eax
test eax, eax
je 0x46c0f7
sub edi, esi
lea edx, [esi + eax*4]
sub ebx, esi
mov ecx, dword [edx + edi]
lea edx, [edx - 4]
xor ecx, dword [edx + 4]
mov dword [edx + ebx + 4], ecx
sub eax, 1
jne 0x46c0e5
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x46c500
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x58
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x64]
push ebx
mov ebx, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x64]
mov dword [esp + 8], ebx
cmp dword [ebx], 0
mov dword [esp + 0xc], eax
je 0x46c642
mov ecx, dword [eax]
test ecx, ecx
je 0x46c642
mov edx, eax
lea eax, [esp + 0x10]
push edi
mov edi, dword [0x58c1ec]
sub edx, eax
lea eax, [edx + ecx*4]
mov eax, dword [esp + eax + 0x14]
mov eax, dword [edi + eax*4]
mov dword [esp + ecx*4 + 0x14], eax
sub ecx, 1
jne 0x46c546
push 0x90
push ecx
push esi
call fcn.00505530
mov edi, dword [ebx]
add esp, 0xc
test edi, edi
je 0x46c5da
mov ecx, dword [0x58c1ec]
push ebp
mov ebp, dword [0x58c1e8]
jmp 0x46c580
mov eax, dword [ebx + edi*4]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0x7fff
je 0x46c5d0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x46c5d0
lea edx, [eax - 1]
add edx, edi
lea edx, [esi + edx*4]
mov ecx, dword [esp + eax*4 + 0x18]
cmp ecx, 0x7fff
je 0x46c5c2
add ecx, ebx
cmp ecx, 0x7fff
jb 0x46c5bc
add ecx, 0xffff8001
mov ecx, dword [ebp + ecx*4]
xor dword [edx], ecx
sub edx, 4
sub eax, 1
jne 0x46c5a0
mov ecx, dword [0x58c1ec]
mov ebx, dword [esp + 0x10]
sub edi, 1
jne 0x46c580
pop ebp
mov eax, dword [esp + 0x10]
mov edx, dword [ebx]
pop edi
mov ecx, dword [eax]
dec ecx
add edx, ecx
mov dword [esi], edx
cmp edx, 0x11
jle 0x46c60e
lea ecx, [esi - 0x38]
lea ecx, [ecx + edx*4]
add edx, 0xffffffef
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub edx, 1
jne 0x46c5f6
cmp dword [esi], 0x11
jbe 0x46c648
mov dword [esi], 0x11
lea esp, [esp]
mov eax, dword [esi]
cmp dword [esi + eax*4], 0
jne 0x46c648
add eax, 0xffffffff
mov dword [esi], eax
jne 0x46c620
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00502f8e
add esp, 0x58
ret 0xc
mov dword [esi], 0
mov ecx, dword [esp + 0x5c]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x58
ret 0xc
Function at 0x46c7a0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov ecx, dword [edi]
test ecx, ecx
je 0x46c89a
mov eax, dword [edi + ecx*4]
push ebx
mov ebx, dword [0x58c1e8]
push ebp
mov ebp, dword [0x58c1ec]
push esi
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x46c7e7
add eax, eax
cmp eax, 0x7fff
jb 0x46c7da
add eax, 0xffff8001
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + eax*4]
mov dword [edx + ecx*8 - 4], eax
jmp 0x46c7f3
mov edx, dword [esp + 0x14]
mov dword [edx + ecx*8 - 4], 0
mov esi, dword [edi]
sub esi, 1
je 0x46c848
lea ecx, [esi*8 - 4]
add ecx, edx
jmp 0x46c810
mov dword [ecx + 4], 0
mov eax, dword [edi + esi*4]
mov eax, dword [ebp + eax*4]
cmp eax, 0x7fff
je 0x46c83a
add eax, eax
cmp eax, 0x7fff
jb 0x46c833
add eax, 0xffff8001
mov eax, dword [ebx + eax*4]
mov dword [ecx], eax
jmp 0x46c840
mov dword [ecx], 0
sub ecx, 8
sub esi, 1
jne 0x46c810
mov eax, dword [edi]
lea esi, [eax*2 - 1]
mov dword [edx], esi
cmp esi, 0x11
jle 0x46c879
lea ecx, [esi - 0xe]
add esi, 0xffffffef
lea ecx, [edx + ecx*4]
mov eax, dword [ecx + 0x38]
lea ecx, [ecx - 4]
xor dword [ecx - 8], eax
xor dword [ecx + 4], eax
mov dword [ecx + 0x3c], 0
sub esi, 1
jne 0x46c861
cmp dword [edx], 0x11
pop esi
pop ebp
pop ebx
jbe 0x46c8a4
mov dword [edx], 0x11
mov eax, dword [edx]
cmp dword [edx + eax*4], 0
jne 0x46c8a4
add eax, 0xffffffff
mov dword [edx], eax
jne 0x46c887
pop edi
ret 8
mov eax, dword [esp + 8]
mov dword [eax], 0
pop edi
ret 8
Function at 0x472400
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ec4b
mov eax, dword fs:[0]
push eax
mov eax, 0x5028
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3010]
push 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x4725ef
cmp eax, 0x800
jae 0x4725ef
push 0x800
lea eax, [ebp - 0x4010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x4725ef
cmp eax, 0x800
jae 0x4725ef
lea eax, [ebp - 0x3010]
push eax
call fcn.00485280
mov ebx, eax
lea eax, [ebp - 0x4010]
push eax
call fcn.00485280
mov esi, eax
cmp word [esi], 0
je 0x4725ef
push esi
push ebx
call fcn.004a05e0
test eax, eax
je 0x4725ef
push esi
push edi
call fcn.00485280
push eax
call fcn.004a05e0
test eax, eax
jne 0x4725ef
mov word [ebp - 0x1010], ax
xor esi, esi
test ax, ax
jne 0x472541
push 0x800
push edi
lea eax, [ebp - 0x1010]
push eax
call fcn.0049ce90
push esi
push str.rtmp_d
push 0x800
lea eax, [ebp - 0x1010]
push eax
call fcn.00485280
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [ebp - 0x1010]
push eax
call fcn.00474160
test al, al
je 0x472526
xor eax, eax
mov word [ebp - 0x1010], ax
jmp 0x47252d
mov ax, word [ebp - 0x1010]
add esi, 0x7b
cmp esi, 0x2710
jl 0x4724d4
test ax, ax
je 0x4725ef
push 0x800
push edi
lea eax, [ebp - 0x2010]
push eax
call fcn.0049ce90
push 0x800
push ebx
lea eax, [ebp - 0x2010]
push eax
call fcn.00485380
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x2010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4725ef
lea ecx, [ebp - 0x5034]
call fcn.00472610
mov dword [ebp - 4], 0
xor bl, bl
push edi
call fcn.00474160
test al, al
jne 0x4725ab
push 0x12
push edi
lea ecx, [ebp - 0x5034]
call fcn.00472990
mov bl, al
lea eax, [ebp - 0x2010]
push eax
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test bl, bl
je 0x4725d9
lea ecx, [ebp - 0x5034]
call fcn.00472780
lea ecx, [ebp - 0x5034]
call fcn.00472ab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5034]
call fcn.00472650
mov al, 1
jmp 0x4725f1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00502f8e
mov esp, ebp
pop ebp
ret 4
Function at 0x472b10
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x472b27
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov ebx, dword [esp + 0x14]
push 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x472bcf
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x472b7e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x472b62
cmp eax, 3
jne 0x472b7e
cmp edi, 0x4e20
jbe 0x472b7e
push 0x4e20
push ebx
mov ecx, esi
call fcn.00472b10
pop edi
pop esi
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 1
jne 0x472b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x472b98
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
cmp dword [esi + 0xc], 0
jne 0x472bc5
cmp edi, 0x8000
jbe 0x472bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x472bc5
push 0x8000
push ebx
mov ecx, esi
call fcn.00472b10
pop edi
pop esi
pop ebx
pop ecx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x472d30
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1014
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1010], eax
mov edx, dword [esp + 0x1018]
push ebx
mov ebx, dword [esp + 0x1020]
push ebp
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
cmp byte [edi + 0x1d], 0
mov dword [edi + 0x1020], 0
jne 0x472d78
test bl, 4
jne 0x472d78
xor cl, cl
jmp 0x472d7a
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x472d9f
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x472dae
or ebx, 2
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
cmp byte [edi + 0x1c], 0
mov dword [esp + 0x18], eax
je 0x472dcc
or esi, 0x100
push 0
push eax
push 3
push 0
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x472e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
push 0x800
push eax
push dword [esp + 0x1c]
call fcn.00484980
test al, al
je 0x472e31
push 0
push dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x472e2c
mov dword [esp + 0x10], eax
cmp ebp, 0xffffffff
jne 0x472e42
cmp dword [esp + 0x10], 2
jne 0x472e42
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x472e6e
cmp ebp, 0xffffffff
je 0x472e6e
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0
push ebp
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp ebp, 0xffffffff
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
setne bl
mov byte [edi + 0x10], 0
cmp ebp, 0xffffffff
je 0x472e9d
push 0x800
push dword [esp + 0x14]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], ebp
push ecx
call fcn.0049ce90
mov ecx, dword [esp + 0x101c]
mov al, bl
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1014
ret 8
Function at 0x473490
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, ecx
test ebx, ebx
jne 0x4734bf
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1c
ret 8
cmp dword [ebp + 0xc], 1
jne 0x4734d0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp + 4], eax
push esi
push edi
cmp dword [ebp + 0xc], 0
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0
je 0x473532
xor esi, esi
test ebx, ebx
je 0x473559
jmp 0x4734f0
mov eax, ebx
sub eax, esi
cmp eax, 0x4000
jb 0x473500
mov eax, 0x4000
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x3c]
add eax, esi
push eax
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
je 0x473559
add esi, 0x4000
cmp esi, ebx
jb 0x4734f0
jmp 0x473551
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push dword [esp + 0x3c]
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
test al, al
jne 0x47365a
cmp byte [ebp + 0x14], 0
je 0x47365a
cmp dword [ebp + 0xc], 0
jne 0x47365a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [ebp]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x523720]
mov ecx, ebp
call esi
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.004742a0
push edi
mov dword [esp + 0x1c], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
cmp esi, ecx
jb 0x4735f1
ja 0x4735b3
cmp dword [esp + 0x18], ebx
jbe 0x4735f1
mov esi, dword [esp + 0x1c]
mov edx, esi
mov edi, dword [esp + 0x20]
sub edx, ebx
mov eax, edi
sbb eax, ecx
test eax, eax
jg 0x4735f1
jl 0x4735ce
cmp edx, 0xffffffff
ja 0x4735f1
mov eax, ebx
add eax, esi
adc ecx, edi
mov dword [esp + 0x24], ecx
js 0x4735f1
jg 0x4735e1
cmp eax, 0xffffffff
jbe 0x4735f1
lea esi, [ebp + 0x1e]
mov ecx, 0x58c304
push esi
call fcn.0046e030
jmp 0x4735f4
lea esi, [ebp + 0x1e]
push 0
push esi
mov ecx, 0x58c304
call fcn.0046d990
test al, al
je 0x47364a
mov eax, dword [esp + 0x14]
cmp eax, ebx
jae 0x4734d2
test eax, eax
je 0x4734d2
mov edi, dword [ebp]
push 0
mov esi, dword [edi + 0x14]
mov ecx, esi
call dword [0x523720]
mov ecx, ebp
call esi
sub eax, dword [esp + 0x18]
mov esi, dword [edi + 0x10]
mov ecx, esi
sbb edx, 0
push edx
push eax
call dword [0x523720]
mov ecx, ebp
call esi
jmp 0x4734d2
lea edx, [ebp + 0x1e]
mov ecx, 0x58c304
push edx
push 0
call fcn.0046dfe0
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x13]
pop edi
pop esi
mov byte [ebp + 8], 1
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1c
ret 8
Function at 0x4736f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ece8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x5513d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0
jbe 0x473763
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov eax, 0x54
mov word [ebp - 0x20], ax
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
test ecx, ecx
je 0x47378c
cmp byte [esi + 0x10], 0
je 0x473782
mov eax, dword [esi + 8]
add eax, eax
push eax
push ecx
call fcn.0049a3e0
push dword [esi]
call fcn.005097b2
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x473ce0
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test bl, bl
jne 0x473d37
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00484980
test al, al
je 0x473d37
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x473d39
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1004
ret 4

Function at 0x473d60
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x473db7
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00484980
test al, al
je 0x473db7
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x473db9
mov al, bl
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1004
ret 4