joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425da6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [esi]
mov ebx, dword [esi + 4]
jl 0x425e1a
jg 0x425dcf
cmp dword [ebp + 8], 0
jbe 0x425e1a
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
inc dl
movzx edx, dl
mov ecx, dword [esi + edx*4 + 8]
lea eax, [ebx + ecx]
movzx ebx, al
mov eax, dword [esi + ebx*4 + 8]
mov dword [esi + edx*4 + 8], eax
mov dword [esi + ebx*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 8]
mov al, byte [esi + eax*4 + 8]
xor byte [edi + ecx], al
add edi, 1
mov eax, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jl 0x425dd8
jg 0x425e1a
cmp edi, dword [ebp + 8]
jb 0x425dd8
pop edi
mov dword [esi + 4], ebx
mov dword [esi], edx
pop esi
pop ebx
leave
ret

Function at 0x426169
Capabilities:
Check mutex on windows

Disassembly:
push 0x5c
mov eax, 0x4f53a9
call fcn.004cb654
mov esi, ecx
lea ecx, [ebp - 0x2c]
xor ebx, ebx
call fcn.004402d1
push 0x51f478
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.004408e0
xor eax, eax
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x44]
push eax
call fcn.0044341f
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.00440d86
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.0042cfc8
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x68]
call fcn.00445b29
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
movzx ebx, bl
push 1
pop ecx
cmove ebx, ecx
cmp eax, 0xb7
jne 0x426206
mov bl, cl
test edi, edi
je 0x426206
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
xor esi, esi
lea ecx, [ebp - 0x2c]
test bl, bl
cmove esi, edi
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret
Function at 0x427445
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test esi, esi
jne 0x427457
push 0xffffffffffffff88
pop eax
jmp 0x4274e9
push edi
push dword [ebp + 8]
movzx eax, dx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x427471
or eax, 0xffffffff
jmp 0x4274e8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x427482
push 0xfffffffffffffffe
pop eax
jmp 0x4274e8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x427494
push 0xfffffffffffffffd
jmp 0x4274e6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jle 0x4274e4
mov ecx, dword [ebp + 0xc]
add ecx, 4
cmp dword [ecx + 0x14], 8
jb 0x4274b0
mov ecx, dword [ecx]
push 0x51f514
push ecx
call fcn.004d7b6e
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4274c7
push 0xfffffffffffffffc
jmp 0x4274e6
push esi
push 1
push edi
push ebx
call fcn.004dbb9a
push esi
call fcn.004db909
push esi
call fcn.004cfe5f
add esp, 0x18
xor eax, eax
jmp 0x4274e7
push 0xfffffffffffffffa
pop eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x42819c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4281e0
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x4281e0
mov ebx, dword [ebp + 8]
jg 0x4281b8
test ebx, ebx
je 0x4281e0
or edx, 0xffffffff
movzx eax, byte [esi]
add ebx, 0xffffffff
movzx ecx, dl
adc edi, 0xffffffff
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x50e658]
mov ecx, ebx
inc esi
or ecx, edi
jne 0x4281bb
not edx
mov eax, edx
jmp 0x4281e2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4281e7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
test esi, esi
je 0x42823b
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jl 0x42823a
mov eax, dword [ebp + 0xc]
jg 0x428205
test eax, eax
je 0x42823a
push ebx
mov ebx, dword [edx + 8]
add eax, 0xffffffff
movzx ecx, bl
mov dword [ebp + 8], eax
movzx eax, byte [esi]
adc edi, 0xffffffff
xor ecx, eax
shr ebx, 8
mov eax, dword [ebp + 8]
xor ebx, dword [ecx*4 + 0x50e658]
inc esi
or eax, edi
mov dword [edx + 8], ebx
mov eax, dword [ebp + 8]
jne 0x428209
add dword [edx], 0xffffffff
pop ebx
adc dword [edx + 4], 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x42850e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f577d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53b070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
lea ecx, [esi + 0x54]
mov dword [ebp - 4], edi
call fcn.00428daf
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 1
call fcn.00428daf
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 2
call fcn.00428daf
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00428daf
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 4
call fcn.00428daf
cmp dword [esi + 0xc], edi
je 0x4285b0
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00428d8a
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
push 0x58
pop ecx
cdq
idiv ecx
imul eax, eax, 0x58
push eax
push dword [esi + 0xc]
call fcn.00401a56
mov dword [esi + 0xc], edi
pop ecx
mov dword [esi + 0x10], edi
pop ecx
mov dword [esi + 0x14], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4293cc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x51f5a0
mov edi, ecx
call esi
push str.psapi.dll
mov dword [ebp - 4], eax
call esi
push str.Wlanapi.dll
mov dword [ebp - 8], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4294ae
push str.CreateToolhelp32Snapshot
push eax
call esi
push str.Process32First
push dword [ebp - 4]
mov dword [edi], eax
call esi
push str.Process32Next
push dword [ebp - 4]
mov dword [edi + 4], eax
call esi
push str.Module32First
push dword [ebp - 4]
mov dword [edi + 8], eax
call esi
push str.Module32Next
push dword [ebp - 4]
mov dword [edi + 0xc], eax
call esi
push str.Thread32First
push dword [ebp - 4]
mov dword [edi + 0x10], eax
call esi
push str.Thread32Next
push dword [ebp - 4]
mov dword [edi + 0x14], eax
call esi
push str.GlobalMemoryStatusEx
push dword [ebp - 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4294f4
push str.EnumProcesses
push eax
call esi
push str.EnumProcessModules
push dword [ebp - 8]
mov dword [edi + 0x1c], eax
call esi
push str.EnumProcessModulesEx
push dword [ebp - 8]
mov dword [edi + 0x24], eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 8]
mov dword [edi + 0x28], eax
call esi
push str.GetProcessImageFileNameW
push dword [ebp - 8]
mov dword [edi + 0x20], eax
call esi
mov dword [edi + 0x2c], eax
test ebx, ebx
je 0x429571
push str.WlanOpenHandle
push ebx
call esi
push str.WlanEnumInterfaces
push ebx
mov dword [edi + 0x34], eax
call esi
push str.WlanGetAvailableNetworkList
push ebx
mov dword [edi + 0x38], eax
call esi
push str.WlanGetProfile
push ebx
mov dword [edi + 0x3c], eax
call esi
push str.WlanCloseHandle
push ebx
mov dword [edi + 0x40], eax
call esi
push str.WlanFreeMemory
push ebx
mov dword [edi + 0x44], eax
call esi
push str.WlanDeleteProfile
push ebx
mov dword [edi + 0x48], eax
call esi
push str.WlanDisconnect
push ebx
mov dword [edi + 0x4c], eax
call esi
push str.WlanSetProfile
push ebx
mov dword [edi + 0x50], eax
call esi
push str.WlanConnect
push ebx
mov dword [edi + 0x54], eax
call esi
push str.WlanGetNetworkBssList
push ebx
mov dword [edi + 0x58], eax
call esi
mov dword [edi + 0x5c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4299b1
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x53b070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
mov esi, ecx
lea eax, [ebp - 0x204]
push 0
mov dword [ebp - 0x208], esi
push eax
mov dword [ebp - 0x208], esi
call fcn.004cd440
add esp, 0xc
mov dword [ebp - 0x208], 0x100
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.004408e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004ca9ff
leave
ret

Function at 0x429b90
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x4f5b62
call fcn.004cb654
mov esi, ecx
mov dword [ebp - 0x220], esi
xor edi, edi
lea eax, [ebp - 0x218]
push 0x208
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x224], esi
push eax
mov dword [ebp - 0x21c], edi
call fcn.004cd440
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004408e0
mov dword [ebp - 4], edi
mov ecx, esi
push edi
mov dword [ebp - 0x21c], 1
call fcn.00441208
mov eax, esi
call fcn.004cb5fe
ret

Function at 0x429dc2
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4f5bd2
call fcn.004cb654
mov esi, ecx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x240], esi
call fcn.00429b15
test al, al
je 0x429df6
mov dl, 1
mov ecx, esi
call fcn.00429c0a
jmp 0x429eb0
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004cd440
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x429de8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.004408e0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.00442055
push 0
lea ecx, [ebp - 0x238]
call fcn.00441208
lea edx, [ebp - 0x239]
lea ecx, [ebp - 0x238]
call fcn.0042acce
test al, al
jne 0x429e70
lea ecx, [ebp - 0x238]
call fcn.0042a6dd
lea ecx, [ebp - 0x238]
call fcn.0042aa66
test al, al
jne 0x429e8a
mov dl, 1
mov ecx, esi
call fcn.00429c0a
jmp 0x429ea5
push 1
lea ecx, [ebp - 0x238]
call fcn.00441208
lea eax, [ebp - 0x238]
mov ecx, esi
push eax
call fcn.0044093d
lea ecx, [ebp - 0x238]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret
Function at 0x42a161
Capabilities:
Clear file content

Disassembly:
push 0x2c
mov eax, 0x4f5c65
call fcn.004cb654
lea eax, [ebp - 0x2c]
push eax
call fcn.00442749
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
jg 0x42a18b
jl 0x42a187
cmp dword [ebp + 8], esi
ja 0x42a18b
push 0xffffffffffffff9c
jmp 0x42a1ec
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42a1ea
push esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x42a1de
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
and esi, 3
add esi, 0xfffffffd
jmp 0x42a1e1
push 0xfffffffffffffffb
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42a1ed
push 0xfffffffffffffff7
pop esi
lea ecx, [ebp - 0x2c]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret
Function at 0x42a6dd
Capabilities:
Create directory

Disassembly:
push 0x6c
mov eax, 0x4f5d8c
call fcn.004cb654
lea eax, [ebp - 0x64]
push eax
call fcn.00442161
xor ebx, ebx
lea ecx, [ebp - 0x64]
push ebx
mov dword [ebp - 4], ebx
call fcn.00441208
lea ecx, [ebp - 0x2c]
call fcn.004402d1
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
push 0x51f8dc
mov byte [ebp - 0x65], bl
call fcn.004408e0
push ebx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.00441fa6
lea ecx, [ebp - 0x48]
mov bl, al
call fcn.00440d86
test bl, bl
je 0x42a752
cmp dword [ebp - 0x50], 2
jne 0x42a74e
or esi, 0xffffffff
jmp 0x42a893
mov bl, 1
jmp 0x42a755
mov bl, byte [ebp - 0x65]
push 0x51defc
lea ecx, [ebp - 0x48]
call fcn.004408e0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x64]
call fcn.00442b41
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00440d86
mov eax, dword [ebp - 0x74]
xor esi, esi
sub eax, dword [ebp - 0x78]
push 0x1c
cdq
pop edi
idiv edi
mov dword [ebp - 0x6c], esi
test eax, eax
je 0x42a893
mov edi, esi
mov eax, dword [ebp - 0x78]
cmp dword [edi + eax + 0x14], esi
je 0x42a879
cmp dword [ebp - 0x18], 0
je 0x42a7d9
push 0x51df14
lea ecx, [ebp - 0x48]
call fcn.004408e0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
call fcn.0042cfc8
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00440d86
test bl, bl
je 0x42a80c
cmp dword [ebp - 0x18], 0
jne 0x42a80c
push 0x51f8dc
lea ecx, [ebp - 0x48]
call fcn.004408e0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x28]
call fcn.0042cfc8
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00440d86
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x28]
add eax, 4
add eax, edi
push eax
call fcn.0042cfc8
push 0x51f4e4
lea ecx, [ebp - 0x2c]
call fcn.00440986
test al, al
jne 0x42a879
push 0x51f590
lea ecx, [ebp - 0x2c]
call fcn.00440986
test al, al
jne 0x42a879
cmp dword [ebp - 0x18], 2
jne 0x42a857
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp word [eax + 2], 0x3a
je 0x42a879
lea edx, [ebp - 0x65]
lea ecx, [ebp - 0x2c]
call fcn.0042acce
test al, al
jne 0x42a879
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp - 0x78]
push 0x1c
pop ecx
cdq
add edi, ecx
idiv ecx
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jb 0x42a79d
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.00428daf
lea ecx, [ebp - 0x2c]
call fcn.00440d86
lea ecx, [ebp - 0x64]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret
Function at 0x42a8b7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x4f5db9
call fcn.004cb654
lea eax, [ebp - 0x2c]
push eax
call fcn.00442161
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0042acce
test al, al
jne 0x42a8e5
or esi, 0xffffffff
jmp 0x42a935
cmp dword [ebp - 0x18], 0x104
jl 0x42a8f6
lea ecx, [ebp - 0x2c]
call fcn.004423b6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x42a913
push 0xffffffffffffff9c
jmp 0x42a934
test cl, 1
je 0x42a935
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42a935
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret

Function at 0x42a945
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x24
mov eax, 0x4f5db9
call fcn.004cb654
lea eax, [ebp - 0x2c]
push eax
call fcn.00442161
xor esi, esi
lea edx, [ebp - 0x2d]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.0042acce
test al, al
jne 0x42a973
or esi, 0xffffffff
jmp 0x42a9c3
cmp dword [ebp - 0x18], 0x104
jl 0x42a984
lea ecx, [ebp - 0x2c]
call fcn.004423b6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x42a9a1
push 0xffffffffffffff9c
jmp 0x42a9c2
test cl, 2
je 0x42a9c3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
and ecx, 0xfffffffd
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42a9c3
push 0xfffffffffffffffd
pop esi
lea ecx, [ebp - 0x2c]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret

Function at 0x42acce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x24
mov eax, 0x4f5db9
call fcn.004cb654
mov esi, edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00442161
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x104
jl 0x42acfb
lea ecx, [ebp - 0x2c]
call fcn.004423b6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42ad1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42ad23
shr al, 4
mov bl, 1
and al, 1
mov byte [esi], al
lea ecx, [ebp - 0x2c]
call fcn.00440d86
mov al, bl
call fcn.004cb5fe
ret
Function at 0x42b0b7
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x4f5f41
call fcn.004cb654
lea eax, [ebp - 0x2c]
push eax
call fcn.00442161
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x104
jl 0x42b0fd
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004422e0
add eax, 4
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0044341f
lea ecx, [ebp - 0x48]
call fcn.00440d86
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.00440d86
mov al, bl
call fcn.004cb5fe
ret

Function at 0x42b124
Capabilities:
Move file

Disassembly:
push 0x5c
mov eax, 0x4f5f86
call fcn.004cb654
mov esi, edx
lea eax, [ebp - 0x48]
push eax
call fcn.00442161
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.00442161
mov esi, 0x104
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], esi
jl 0x42b180
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x48]
call fcn.00442427
add eax, 4
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x44]
call fcn.0044341f
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00440d86
cmp dword [ebp - 0x18], esi
jl 0x42b1a9
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00442427
add eax, 4
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.0044341f
lea ecx, [ebp - 0x64]
call fcn.00440d86
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x30], 8
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
lea ecx, [ebp - 0x2c]
setne bl
call fcn.00440d86
lea ecx, [ebp - 0x48]
call fcn.00440d86
mov al, bl
call fcn.004cb5fe
ret
Function at 0x42b1e4
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x53b070]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x42b20e
xor eax, eax
jmp 0x42b320
push 0x40
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004cd440
push edi
push 1
lea eax, [esp + 0x24]
push 0x40
push eax
call fcn.004d82f6
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x42b23b
push 0xfffffffffffffffc
jmp 0x42b31d
mov eax, 0x5a4d
cmp word [esp + 0x10], ax
je 0x42b24e
push 0xfffffffffffffffb
jmp 0x42b31d
push ebx
push dword [esp + 0x50]
push edi
call fcn.004d810f
add esp, 0xc
test eax, eax
je 0x42b267
push 0xfffffffffffffffa
jmp 0x42b31d
mov esi, 0xf8
lea eax, [esp + 0x50]
push esi
push ebx
push eax
call fcn.004cd440
push 0x108
lea eax, [esp + 0x158]
push ebx
push eax
call fcn.004cd440
push edi
push 1
lea eax, [esp + 0x70]
push esi
push eax
call fcn.004d82f6
add esp, 0x28
cmp eax, 0xffffffff
jne 0x42b2a5
push 0xfffffffffffffff9
jmp 0x42b31d
cmp dword [esp + 0x50], 0x4550
je 0x42b2b3
push 0xfffffffffffffff8
jmp 0x42b31d
mov eax, 0x10b
cmp word [esp + 0x68], ax
jne 0x42b2c4
xor esi, esi
inc esi
jmp 0x42b31e
mov eax, 0x20b
cmp word [esp + 0x68], ax
jne 0x42b31b
push 2
pop esi
push ebx
push dword [esp + 0x50]
push edi
call fcn.004d810f
add esp, 0xc
test eax, eax
je 0x42b2e9
push 0xfffffffffffffff6
jmp 0x42b31d
push edi
push 1
lea eax, [esp + 0x150]
push 0x108
push eax
call fcn.004d82f6
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42b30a
push 0xfffffffffffffff5
jmp 0x42b31d
cmp dword [esp + 0x148], 0x4550
je 0x42b31e
push 0xfffffffffffffff4
jmp 0x42b31d
push 0xfffffffffffffff7
pop esi
mov eax, esi
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ca9ff
mov esp, ebp
pop ebp
ret
Function at 0x42b335
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x50
mov eax, 0x4f5fbb
call fcn.004cb654
mov edi, edx
mov dword [ebp - 0x5c], edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 7
push eax
call fcn.00440dcf
and dword [ebp - 4], 0
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x42b363
mov esi, dword [esi]
push 0x51f914
push esi
call fcn.004d7b6e
pop ecx
pop ecx
mov ebx, eax
mov dword [ebp - 0x58], ebx
push 0x64
pop esi
test ebx, ebx
jne 0x42b384
or esi, 0xffffffff
jmp 0x42b4d9
push 2
push 0
push ebx
call fcn.004d810f
add esp, 0xc
push ebx
call fcn.004dc9d0
pop ecx
push 0
push 0
push ebx
mov dword [ebp - 0x4c], eax
call fcn.004d810f
lea ecx, [edi + 4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x42b3b3
mov ecx, dword [ecx]
push 0x51f91c
push ecx
call fcn.004d7b6e
mov dword [ebp - 0x54], eax
pop ecx
pop ecx
test eax, eax
jne 0x42b3d6
push ebx
call fcn.004cfe5f
pop ecx
push 0xfffffffffffffffd
pop esi
jmp 0x42b4d9
mov ecx, ebx
xor edi, edi
call fcn.0042b1e4
mov dword [ebp - 0x50], eax
cmp eax, 1
je 0x42b3f3
cmp eax, 2
je 0x42b3f3
mov esi, eax
jmp 0x42b4aa
push 0
push 0
push ebx
call fcn.004d810f
add esp, 0xc
push dword [ebp - 0x4c]
call fcn.004cac4e
pop ecx
push ebx
push 1
push dword [ebp - 0x4c]
mov edi, eax
push edi
call fcn.004d82f6
add esp, 0x10
cmp eax, 0xffffffff
jne 0x42b427
push 0xfffffffffffffff3
pop esi
jmp 0x42b4aa
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x14]
add ecx, eax
movzx eax, word [eax + edi + 6]
movzx edx, ax
lea eax, [edi + 0x18]
add eax, ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], eax
test edx, edx
je 0x42b4aa
mov ebx, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00440806
push 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.004426f7
test eax, eax
jne 0x42b48c
mov eax, dword [ebp - 0x4c]
push ebx
push 1
push dword [eax + 8]
mov eax, dword [eax + 0x14]
add eax, edi
push eax
call fcn.004dbb9a
add esp, 0x10
xor ecx, ecx
cmp eax, 0xffffffff
push 0xfffffffffffffff1
pop esi
cmovne esi, ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00440d86
mov eax, dword [ebp - 0x4c]
add eax, 0x28
sub dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], eax
jne 0x42b44b
mov ebx, dword [ebp - 0x58]
push ebx
call fcn.004cfe5f
mov ebx, dword [ebp - 0x54]
pop ecx
push ebx
call fcn.004db909
pop ecx
push ebx
call fcn.004cfe5f
pop ecx
test edi, edi
je 0x42b4cd
push edi
call fcn.004cac49
pop ecx
test esi, esi
je 0x42b4d9
mov ecx, dword [ebp - 0x5c]
call fcn.0042b0b7
lea ecx, [ebp - 0x48]
call fcn.00440d86
mov eax, esi
call fcn.004cb5fe
ret