joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479e80
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push 0x3c
mov ebx, ecx
call fcn.0052b380
mov esi, eax
add esp, 4
test esi, esi
je 0x479ed6
mov ecx, ebx
call fcn.00442f50
test eax, eax
je 0x479eaf
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x1c]
mov cl, byte [eax + 0x109]
test cl, cl
jne 0x479ec5
mov eax, dword [ebx + 0x24]
mov ecx, dword [eax + 4]
cmp eax, dword [ecx + 0x3bc]
jne 0x479ec5
mov eax, dword [ecx + 0x3b8]
jmp 0x479ec8
add eax, 0xc
push eax
mov ecx, esi
call fcn.00452770
mov esi, eax
test esi, esi
jne 0x479edd
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, dword [ebx + 0x48]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov dword [ebx + 0x48], esi
push ebp
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp]
mov dword [esi + 0x1c], edx
movzx cx, byte [eax + 3]
mov word [esi + 0xa], cx
movzx dx, byte [eax]
mov word [esi + 8], dx
movzx cx, byte [eax + 1]
mov word [esi + 6], cx
movzx dx, byte [eax + 2]
mov eax, dword [esp + 0x14]
test eax, eax
push edi
lea edi, [esi + 4]
mov word [edi], dx
je 0x479f33
lea ecx, [eax + 0x1c]
cmp dword [ecx], 0
je 0x479f33
push 1
push edi
call fcn.00459650
movzx eax, word [edi + 6]
cmp eax, 0xff
jge 0x479f6e
movzx ecx, word [edi + 4]
movzx edx, word [edi + 2]
inc eax
imul ecx, eax
imul edx, eax
sar ecx, 8
mov word [edi + 4], cx
movzx ecx, word [edi]
imul ecx, eax
sar edx, 8
sar ecx, 8
mov word [edi + 2], dx
mov word [edi], cx
mov eax, 1
jmp 0x479f70
xor eax, eax
mov ecx, ebx
mov byte [esi + 0x24], al
call fcn.00442f50
test eax, eax
je 0x479f93
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x1c]
mov cl, byte [eax + 0x109]
test cl, cl
je 0x479f93
add eax, 0xc
jmp 0x479fac
mov ebx, dword [ebx + 0x24]
mov eax, dword [ebx + 4]
cmp ebx, dword [eax + 0x3bc]
jne 0x479fa9
mov eax, dword [eax + 0x3b8]
jmp 0x479fac
lea eax, [ebx + 0xc]
mov ecx, dword [eax + 0x4c]
test ecx, ecx
je 0x479fba
mov ecx, esi
call fcn.0045d3c0
mov eax, dword [ebp]
inc eax
pop edi
mov dword [ebp], eax
pop ebp
mov eax, esi
pop esi
pop ebx
ret 0xc
Function at 0x498280
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4982ae
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x498291
pop esi
ret 4

Function at 0x4982c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xad4]
mov ecx, dword [ebx + 0xad8]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.0052b380
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xad4], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xad8], esi
mov dword [ebx + 0xae0], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x4983c9
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x4983b8
mov ecx, edi
xor esi, esi
call fcn.004360f0
mov cx, word [eax]
test cx, cx
je 0x49836e
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x498350
mov edx, dword [ebx + 0xad4]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x49839c
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x498390
mov ecx, edi
call fcn.004360f0
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xad4]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x498330
mov edx, dword [esp + 0x14]
push edx
call fcn.00439d00
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x49e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.004360f0
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.004360f0
mov cx, word [eax]
test cx, cx
je 0x49e1f2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x49e1d4
push esi
push ebp
mov ecx, edi
call fcn.0049bf40
mov edx, dword [edi + 0xad4]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x49e221
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.004981e0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x4bcba0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x18], 0xca
jne 0x4bcbdb
push esi
call fcn.004c1410
add esp, 4
test eax, eax
jl 0x4bcc55
mov al, byte [esi + 0x48]
test al, al
je 0x4bcbd4
mov dword [esi + 0x18], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x18], 0xcb
mov eax, dword [esi + 0x18]
cmp eax, 0xcb
jne 0x4bcc57
mov eax, dword [esi + 0x194]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4bcc44
mov eax, dword [esi + 8]
test eax, eax
je 0x4bcbff
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x194]
push esi
call dword [ecx]
add esp, 4
test eax, eax
jl 0x4bcc55
je 0x4bcc40
cmp eax, 2
je 0x4bcc44
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4bcbf2
cmp eax, 3
je 0x4bcc27
cmp eax, 1
jne 0x4bcbf2
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4bcbf2
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x4bcbf2
xor eax, eax
pop esi
ret
mov edx, dword [esi + 0x84]
mov dword [esi + 0x8c], edx
call fcn.004bca80
pop esi
ret
cmp eax, 0xcc
je 0x4bcc50
mov eax, dword [esi]
mov dword [eax + 0x14], 0x11
mov ecx, dword [esi]
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov eax, 0xffffffef
pop esi
ret
Function at 0x4c9560
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x563d54]
test eax, eax
jne 0x4c966c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [0x563d54], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
test esi, esi
je 0x4c9669
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x563d58], eax
je 0x4c9669
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x563d5c], eax
je 0x4c9669
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x563d60], eax
je 0x4c9669
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x563d64], eax
je 0x4c9669
push str.ImmGetCompositionStringW
push esi
call edi
push str.ImmGetOpenStatus
push esi
mov dword [0x563d68], eax
call edi
push str.ImmSetOpenStatus
push esi
mov dword [0x563d6c], eax
call edi
push str.ImmGetConversionStatus
push esi
mov dword [0x563d70], eax
call edi
push str.ImmSetConversionStatus
push esi
mov dword [0x563d74], eax
call edi
push str.ImmSetCompositionStringW
push esi
mov dword [0x563d78], eax
call edi
push str.ImmNotifyIME
push esi
mov dword [0x563d7c], eax
call edi
push str.ImmGetCandidateListW
push esi
mov dword [0x563d80], eax
call edi
mov dword [0x563d84], eax
mov dword [0x563d54], 2
pop edi
pop esi
pop ebx
ret

Function at 0x4c9670
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 7
lea ecx, [esp + 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4c96ba
push esi
push 0xa
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00495250
add esp, 0x10
test eax, eax
mov eax, dword [esp + 4]
jne 0x4c96bc
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4c9760
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x563d54]
sub esp, 8
test eax, eax
push edi
mov edi, str.UNKNOWN
jne 0x4c9777
call fcn.004c9560
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [0x563d54], 2
jne 0x4c9898
mov eax, dword [0x563d74]
test eax, eax
je 0x4c9898
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x563d58]
mov esi, eax
test esi, esi
je 0x4c9897
push ebx
call fcn.004c9670
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ebx, eax
call dword [0x563d74]
test eax, eax
je case.0x4c9810.17
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jbe 0x4c97e0
sub eax, 0x400
lea ecx, [ebx - 0x3a4]
cmp ecx, 0x12
ja case.0x4c9810.17
movzx ecx, byte [ecx + 0x4c98b0]
jmp dword [ecx*4 + 0x4c98a0]
add eax, 0xfffffff0
cmp eax, 0xb
ja case.0x4c9810.17
movzx edx, byte [eax + 0x4c98dc]
jmp dword [edx*4 + 0x4c98c4]
pop ebx
mov edi, str.ALPHANUMERIC_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_FULL
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_KATAKANA_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.JAPANESE_HIRAGANA
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c9810.17
movzx eax, byte [eax + 0x4c98f8]
jmp dword [eax*4 + 0x4c98e8]
pop ebx
mov edi, str.ALPHANUMERIC_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.KOREAN
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4c9810.17
movzx ecx, byte [eax + 0x4c9914]
jmp dword [ecx*4 + 0x4c9904]
mov edi, str.CHINESE
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x4ca240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 4]
push eax
push 0x20019
xor esi, esi
push esi
push ecx
push edx
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ca2bf
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push esi
push esi
push esi
push edi
push ecx
call ebx
test eax, eax
jne 0x4ca2bd
mov edx, dword [esp + 0x10]
push edx
call fcn.0052b380
mov ecx, dword [esp + 0x10]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push edi
push ecx
call ebx
test eax, eax
je 0x4ca2bd
push esi
call fcn.00439d00
add esp, 4
xor esi, esi
pop edi
pop ebx
mov eax, dword [esp + 4]
test eax, eax
je 0x4ca2ce
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x4ca390
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x54
push ebx
push ebp
push esi
push edi
push str._shellopencommand
push eax
xor ebp, ebp
xor esi, esi
xor edi, edi
call fcn.00435600
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4ca420
push edi
push ebx
push 0x80000000
call fcn.004ca240
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4ca420
mov ecx, dword [esp + 0x6c]
push ecx
push esi
call fcn.004ca2e0
mov edi, eax
add esp, 8
test edi, edi
je 0x4ca420
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4ca420
mov edx, dword [esp + 0x10]
push edx
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00439d00
push esi
call fcn.00439d00
push edi
call fcn.00439d00
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x4cb130
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x4cb1a1
dec eax
jne 0x4cb1bf
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4cb18d
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4cb17a
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x4cb1bf
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x4cb1bf
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4cb1b8
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x4cb1bf
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x4cb850
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 4], 7
jl 0x4cb8a7
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4cb87e
push str.GetUserDefaultUILanguage
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4cb87e
call eax
jmp 0x4cb884
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
test esi, esi
mov edi, eax
je 0x4cb891
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test di, di
je 0x4cb8a2
push edi
call fcn.004cb1d0
add esp, 4
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 4], eax
jmp fcn.004cb1d0
Function at 0x4cdb40
Capabilities:
Create thread
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc5c]
test eax, eax
je 0x4cdba3
mov eax, dword [edi]
call dword [eax + 0xd4]
test eax, eax
jne 0x4cdb69
mov dword [edi + 0x658], 1
pop edi
pop esi
ret 0xc
mov esi, dword [edi + 0xc5c]
mov dword [esi + 0x18], eax
mov dword [edi + 0xc5c], 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4cc140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4cdb9e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 0xc
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4cdb9e
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00435680
mov edx, dword [esp + 0x14]
push edx
mov dword [esi], eax
call fcn.00435680
mov dword [esi + 4], eax
mov al, byte [esp + 0x1c]
add esp, 8
mov byte [esi + 8], al
call fcn.004cb0e0
mov byte [esi + 9], al
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xd8]
mov dword [esi + 0x14], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd4]
mov ecx, edi
mov dword [esi + 0x18], eax
call fcn.004cb510
test al, al
je 0x4cdc0e
mov ecx, dword [edi + 0xae8]
mov dword [esi + 0xc], ecx
jmp 0x4cdc15
mov dword [esi + 0xc], 0
mov edx, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [edx + 0xd8]
mov ebx, eax
call fcn.004cb0e0
test al, al
mov ebp, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
je 0x4cdc5b
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
jmp 0x4cdc82
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
pop ebp
mov dword [esi + 0x10], eax
pop ebx
je 0x4cdb9e
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4cdb7c
mov dword [edi + 0xc5c], esi
mov dword [edi + 0x658], 1
pop edi
pop esi
ret 0xc
Function at 0x4cef80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf08f
cmp byte [esi], 0
je 0x4cf08f
mov ecx, dword [esp + 0x18]
push ebx
or ebx, 0xffffffff
test ecx, ecx
push edi
je 0x4cf079
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf044
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cefec
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf014
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf02a
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf02a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf079
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf082
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.00439d00
add esp, 4
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
pop edi
cmp ebx, 0xffffffff
pop ebx
setne al
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cf0a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf1ab
cmp byte [esi], 0
je 0x4cf1ab
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cf196
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf162
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cf10b
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf133
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf14c
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf14c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf196
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf1a2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret
Function at 0x4cf1c0
Capabilities:
Move file

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4cf38c
cmp byte [esi], 0
je 0x4cf38c
push ebp
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x4cf384
cmp byte [ebp], 0
je 0x4cf384
mov ecx, dword [esp + 0x2c]
test ecx, ecx
push edi
mov byte [esp + 0x28], 0
je 0x4cf36a
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf317
push ebx
push 0x5481a0
lea ecx, [esp + 0x20]
call fcn.00435980
push esi
lea ecx, [esp + 0x20]
call fcn.00435140
cmp edi, 5
jle 0x4cf245
mov eax, dword [esp + 0x1c]
push eax
call fcn.004b8000
add esp, 4
mov ebx, eax
jmp 0x4cf271
mov ecx, dword [esp + 0x1c]
push 0
push 6
push ecx
call fcn.004b8440
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4cf2fe
push esi
call fcn.004b8000
push esi
mov ebx, eax
call fcn.00439d00
add esp, 8
test ebx, ebx
je 0x4cf2fe
push 0x5481a0
lea ecx, [esp + 0x14]
call fcn.00435980
push ebp
lea ecx, [esp + 0x14]
call fcn.00435140
cmp edi, 5
jle 0x4cf2a7
mov edx, dword [esp + 0x10]
push edx
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf2cf
mov eax, dword [esp + 0x10]
push 0
push 6
push eax
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf2eb
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf2eb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
push esi
setne byte [esp + 0x30]
call fcn.00439d00
add esp, 4
push ebx
call fcn.00439d00
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00439d00
add esp, 8
mov edx, dword [esp + 0x1c]
push edx
call fcn.00439d00
mov al, byte [esp + 0x30]
add esp, 4
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x18
ret
cmp edi, 5
jle 0x4cf36a
push 0
push ebp
call fcn.004d9d70
mov edi, eax
add esp, 8
test edi, edi
je 0x4cf379
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf356
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
push esi
setne byte [esp + 0x2c]
call fcn.00439d00
add esp, 4
push edi
call fcn.00439d00
mov al, byte [esp + 0x2c]
add esp, 4
pop edi
pop ebp
pop esi
add esp, 0x18
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne byte [esp + 0x28]
mov al, byte [esp + 0x28]
pop edi
pop ebp
pop esi
add esp, 0x18
ret
pop ebp
xor al, al
pop esi
add esp, 0x18
ret
xor al, al
pop esi
add esp, 0x18
ret
Function at 0x4cf3a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf4ab
cmp byte [esi], 0
je 0x4cf4ab
mov ecx, dword [esp + 0x18]
push ebx
xor bl, bl
test ecx, ecx
push edi
je 0x4cf496
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf462
push 0x5481a0
lea ecx, [esp + 0x10]
call fcn.00435980
push esi
lea ecx, [esp + 0x10]
call fcn.00435140
cmp edi, 5
jle 0x4cf40b
mov eax, dword [esp + 0xc]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf433
mov ecx, dword [esp + 0xc]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf44c
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf44c
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
cmp edi, 5
jle 0x4cf496
push 0
push esi
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf4a2
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
push esi
setne bl
call fcn.00439d00
add esp, 4
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
add esp, 0xc
ret
xor al, al
pop esi
add esp, 0xc
ret

Function at 0x4cf4c0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4cf570
cmp byte [esi], 0
je 0x4cf570
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4cf5af
push edi
call fcn.00497d20
mov edi, eax
call fcn.004cb0e0
test al, al
je 0x4cf575
push 0x5481a0
lea ecx, [esp + 0xc]
call fcn.00435980
push esi
lea ecx, [esp + 0xc]
call fcn.00435140
cmp edi, 5
jle 0x4cf524
mov eax, dword [esp + 8]
push eax
call fcn.004b8000
add esp, 4
mov esi, eax
jmp 0x4cf54c
mov ecx, dword [esp + 8]
push 0
push 6
push ecx
call fcn.004b8440
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cf562
push edi
call fcn.004b8000
push edi
mov esi, eax
call fcn.00439d00
add esp, 8
test esi, esi
je 0x4cf562
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00439d00
add esp, 4
mov edx, dword [esp + 8]
push edx
call fcn.00439d00
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
cmp edi, 5
push 0
push esi
jle 0x4cf5a3
call fcn.004d9d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4cf56f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call fcn.00439d00
add esp, 4
pop edi
pop esi
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0xc
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
add esp, 0xc
ret