joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e49f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Killprocess
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e4e8
mov eax, dword [eax + 4]
jmp 0x43e4eb
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CKillprocessHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e575
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Copyfile
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e5be
mov eax, dword [eax + 4]
jmp 0x43e5c1
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CCopyfileHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e64b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Exec
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e694
mov eax, dword [eax + 4]
jmp 0x43e697
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CExecHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e721
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Registry
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e76a
mov eax, dword [eax + 4]
jmp 0x43e76d
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CRegistryHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e7f7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Dependency
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e840
mov eax, dword [eax + 4]
jmp 0x43e843
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CDependencyHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e8cd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Regdll
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e916
mov eax, dword [eax + 4]
jmp 0x43e919
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CRegdllHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43e9a3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Checkexist
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43e9ec
mov eax, dword [eax + 4]
jmp 0x43e9ef
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CCheckexistHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ea79
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x486028
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43eac2
mov eax, dword [eax + 4]
jmp 0x43eac5
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.C0Handler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43eb4f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x48602c
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43eb98
mov eax, dword [eax + 4]
jmp 0x43eb9b
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.C1Handler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ec25
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x486030
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43ec6e
mov eax, dword [eax + 4]
jmp 0x43ec71
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CCreatelinkHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ecfb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Createdir
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43ed44
mov eax, dword [eax + 4]
jmp 0x43ed47
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CCreatedirHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43edd1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.DownloadFile
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43ee1a
mov eax, dword [eax + 4]
jmp 0x43ee1d
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CDownloadFileHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43eea7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.RuntimeParamStatistic
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43eef0
mov eax, dword [eax + 4]
jmp 0x43eef3
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CRuntimeParamStatisticHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ef7d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x4860a4
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43efc6
mov eax, dword [eax + 4]
jmp 0x43efc9
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CRegistryVersionHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f05b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Unpack
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43f0a4
mov eax, dword [eax + 4]
jmp 0x43f0a7
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CUnpackHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f131
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.UnpackFile
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43f17a
mov eax, dword [eax + 4]
jmp 0x43f17d
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CUnpackFileHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43f207
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.Delete
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43f250
mov eax, dword [eax + 4]
jmp 0x43f253
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CDeleteHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f2dd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x472ee1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x4a0590]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.DeleteFile
lea ebx, [esp + 0x10]
call fcn.0044088e
pop ecx
and dword [esp + 0x38], 0
cmp dword [eax + 0x18], 8
jb 0x43f326
mov eax, dword [eax + 4]
jmp 0x43f329
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
push esi
call fcn.0043df10
lea eax, [esp + 0xc]
call fcn.0043b39a
mov dword [esi], vtable.CDeleteFileHandler.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f3b3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
call fcn.0043f42b
lea eax, [ebp - 4]
push eax
push 0x102
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f41e
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MaxConnectionsPer1_0Server
push dword [ebp - 4]
mov dword [ebp - 8], 0x32
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MaxConnectionsPerServer
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x43f42b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x101
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
mov byte [esi + 1], 0
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f4c8
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.MaxConnectionsPer1_0Server
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x43f48f
cmp dword [ebp - 8], ebx
jne 0x43f48f
mov eax, dword [ebp - 0xc]
mov byte [esi], 1
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.MaxConnectionsPerServer
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x43f4bd
cmp dword [ebp - 8], ebx
jne 0x43f4bd
mov eax, dword [ebp - 0xc]
mov byte [esi + 1], 1
mov dword [esi + 8], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret

Function at 0x43f4ca
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x102
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43f552
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [esi], bl
je 0x43f512
push 4
lea eax, [esi + 4]
push eax
push 4
push ebx
push str.MaxConnectionsPer1_0Server
push dword [ebp - 4]
call edi
jmp 0x43f520
push str.MaxConnectionsPer1_0Server
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [esi + 1], bl
je 0x43f53a
push 4
add esi, 8
push esi
push 4
push ebx
push str.MaxConnectionsPerServer
push dword [ebp - 4]
call edi
jmp 0x43f548
push str.MaxConnectionsPerServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x441e32
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 0x94
mov eax, 0x471ff5
call fcn.00459c76
mov edi, ecx
mov esi, edx
xor ebx, ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x74], ebx
call fcn.0043bdc9
lea eax, [ebp - 0x70]
mov dword [ebp - 4], ebx
call fcn.0043bdc9
lea eax, [ebp - 0x30]
call fcn.0043bdc9
mov byte [ebp - 4], 2
cmp edi, ebx
je 0x441fc5
cmp word [edi], bx
je 0x441fc5
push edi
call fcn.00444089
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x441fc5
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
je 0x441fc5
and eax, 1
cmp al, 1
jne 0x441eb3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.00448134
push eax
mov eax, edi
call fcn.0043ca77
test eax, eax
je 0x441fc5
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x441fa8
push edi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00447e69
mov edx, dword [ebp - 0x6c]
add esp, 0xc
cmp dword [ebp - 0x58], 8
jae 0x441ef4
lea edx, [ebp - 0x6c]
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x441f00
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00447f63
pop ecx
mov edi, eax
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0043ba47
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
call fcn.0043b39a
sub esp, 0x20
mov edi, esi
mov eax, esp
mov dword [ebp - 0x80], esp
call fcn.0043b3b5
mov ebx, dword [ebp - 0x7c]
call fcn.004440c2
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x441f4d
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x441f85
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x441f67
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x441fa8
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x441f7e
lea eax, [ebp - 0x2c]
push 4
push 0
push eax
jmp 0x441f8c
push 4
push 0
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x441f9f
mov dword [ebp - 0x74], 0xfffffffa
jmp 0x441fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x30]
call fcn.0043b39a
lea eax, [ebp - 0x70]
call fcn.0043b39a
lea eax, [ebp - 0x50]
call fcn.0043b39a
mov eax, dword [ebp - 0x74]
jmp 0x441fdf
lea eax, [ebp - 0x30]
call fcn.0043b39a
lea eax, [ebp - 0x70]
call fcn.0043b39a
lea eax, [ebp - 0x50]
call fcn.0043b39a
xor eax, eax
call fcn.00459cf9
ret
Function at 0x4420ce
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x2c4
mov eax, 0x472981
call fcn.00459c76
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x2c8], edi
mov dword [ebp - 0x2d0], esi
call fcn.0043bdc9
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
call fcn.0043bdc9
lea eax, [ebp - 0x30]
call fcn.0043bdc9
mov byte [ebp - 4], 2
mov byte [ebp - 0x2c1], 0
test edi, edi
je 0x4422bf
cmp word [edi], 0
je 0x4422bf
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x442157
xor esi, esi
lea eax, [ebp - 0x30]
call fcn.0043b39a
lea eax, [ebp - 0x50]
call fcn.0043b39a
lea eax, [ebp - 0x70]
call fcn.0043b39a
mov eax, esi
jmp 0x4422d9
and eax, 0x10
cmp al, 0x10
je 0x44216b
mov edx, esi
mov ecx, edi
call fcn.00441e32
mov esi, eax
jmp 0x442138
push edi
mov dword [ebp - 0x2cc], 1
call fcn.00444089
mov eax, ebx
xor ebx, ebx
inc ebx
and eax, ebx
cmp al, bl
jne 0x44218f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
lea eax, [ebp - 0x70]
push eax
call fcn.004095cb
lea eax, [ebp - 0x70]
push eax
call fcn.00447e0e
pop ecx
lea edi, [ebp - 0x70]
lea esi, [ebp - 0x30]
call fcn.0043ba47
mov eax, esi
call fcn.00447d9a
push 0x2a
call fcn.0040c1c7
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4421c8
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x2c0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x442263
cmp dword [ebp - 0x2cc], 0
je 0x44225c
lea esi, [ebp - 0x294]
call fcn.00447c9a
test al, al
jne 0x442246
lea edi, [ebp - 0x70]
lea esi, [ebp - 0x50]
call fcn.0043ba47
mov eax, esi
call fcn.00447d9a
lea eax, [ebp - 0x294]
push eax
mov eax, esi
push eax
call fcn.0040baa6
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x442226
lea eax, [ebp - 0x4c]
push dword [ebp - 0x2d0]
push eax
call fcn.004420ce
pop ecx
pop ecx
cmp eax, 0xfffffffa
jne 0x442242
mov byte [ebp - 0x2c1], 1
jmp 0x442246
test eax, eax
jne 0x44225c
lea eax, [ebp - 0x2c0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x2cc], eax
jmp 0x4421e1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00448250
push eax
mov eax, dword [ebp - 0x2c8]
call fcn.00443fd5
test al, al
jne 0x4422a8
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4422a8
push 4
push eax
push dword [ebp - 0x2c8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4422a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4422aa
push 0xfffffffffffffffa
pop eax
jmp 0x4422aa
xor eax, eax
cmp byte [ebp - 0x2c1], 0
je 0x442167
push 0xfffffffffffffffa
pop esi
jmp 0x442138
lea eax, [ebp - 0x30]
call fcn.0043b39a
lea eax, [ebp - 0x50]
call fcn.0043b39a
lea eax, [ebp - 0x70]
call fcn.0043b39a
xor eax, eax
call fcn.00459cf9
ret