joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x17d1751c
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x34326d01
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x40894f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
call fcn.00408980
mov esi, 0x8c9db356
sub esi, 0x6a243c34
xor dword [eax], edi
and edx, edx
inc eax
add esi, edx
and edx, esi
cmp eax, ebx
jne fcn.0040894f
add esi, 0x2933601e
mov edx, 0x1806c28d
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
mov ecx, 0x205f25c6
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..rdata
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x11360c5d
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x404f60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee2b8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push 0x40
push 0
push eax
mov dword [ebp - 0x54], 0x44
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x64]
xor eax, eax
cmp dword [ebp + 0x1c], 8
xorps xmm0, xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x64], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40500f
imul eax, dword [ebp + 0x20], 0x3e8
push eax
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x65], 1
jmp 0x405013
mov byte [ebp - 0x65], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403780
mov al, byte [ebp - 0x65]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4053a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee396
mov eax, dword fs:[0]
push eax
sub esp, 0x8a0
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x50ce1c
push str.powershell.exe
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wsearchenv_s]
add esp, 0x1c
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x405416
xor al, al
jmp 0x4054af
push 0x98
lea eax, [ebp - 0x8a8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0x8a8]
call fcn.0040c5d0
mov dword [ebp - 4], 0
mov edx, 0x50ced4
lea ecx, [ebp - 0x8a8]
call fcn.0040cf80
lea edx, [ebp - 0x810]
mov ecx, eax
call fcn.0040cf80
mov edx, 0x50cecc
mov ecx, eax
call fcn.0040cf80
mov edx, 0x50ced8
mov ecx, eax
call fcn.0040cf80
push 0x14
sub esp, 0x18
lea ecx, [ebp - 0x8a8]
mov eax, esp
mov dword [ebp - 0x8ac], esp
push eax
call fcn.0040c4e0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.00404f60
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.00405320
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret
Function at 0x409be0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef1d3
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x40]
lea ecx, [eax + 0x26]
call fcn.004b6f90
test al, al
je 0x409d9e
push 0x16
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.2345Soft2345Installer
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004037f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x88]
call fcn.004b6a20
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x40]
cmp eax, esi
je 0x409cc3
mov ecx, eax
call fcn.00403780
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.00403780
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403780
push 0xf
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x70]
push str.InstallCfg.data
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.004037f0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x70]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.004b6a20
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.00403780
lea ecx, [ebp - 0x58]
call fcn.004cfb90
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmovae eax, dword [ebp - 0x40]
push eax
call esi
test eax, eax
jne 0x409d92
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 6
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.004d0280
test al, al
je 0x409d86
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.00403780
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00403780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00403780
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret
Function at 0x4130b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f0790
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
xor esi, esi
mov dword [ebp - 0x18], esi
xor bl, bl
push fcn.004120e0
mov byte [ebp - 0x14], bl
push 6
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x413199
cmp dword [ebp - 0x34], esi
je 0x413199
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x30]
push str.9CDB4DA2_ACEA_446E_AA3A_D25628140939__d__p
push eax
call fcn.004b03c0
add esp, 0x10
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x41318a
push 0xffffffffffffffff
push esi
call edi
test eax, eax
jne 0x413179
mov bl, 1
mov byte [ebp - 0x14], bl
jmp 0x41318a
xor bl, bl
push esi
mov byte [ebp - 0x14], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403780
mov dword [ebp - 4], 1
cmp byte [0x53fe88], 0
jne 0x4131d2
mov ecx, dword [0x53fe68]
test ecx, ecx
je 0x4131be
push 0xffffffffffffffff
push ecx
call edi
mov ecx, dword [0x53fe68]
mov eax, dword [0x53fe60]
mov edi, dword [eax]
test ecx, ecx
je 0x4131d4
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4131d4
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test bl, bl
je 0x4131ec
test esi, esi
je 0x4131ff
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4131f0
test esi, esi
je 0x4131ff
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov dword [ebp - 0x18], 0
mov eax, edi
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret
Function at 0x417b10
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f11b1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], cx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x2c], 1
jb 0x417b75
mov eax, dword [eax]
push 0
push eax
push str._s._d.del
push esi
call fcn.004b03c0
add esp, 0x10
cmp dword [esi + 0x10], 0
je 0x417c05
push esi
lea ecx, [ebp - 0x28]
call fcn.0040c400
mov dword [ebp - 4], 1
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.004b6880
lea ecx, [ebp - 0x28]
call fcn.004cf7f0
cmp eax, 0xffffffff
je 0x417bf9
test al, 0x10
je 0x417bf9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403780
cmp dword [esi + 0x10], 0
je 0x417c05
mov ecx, esi
call fcn.004cfb90
test al, al
je 0x417be2
mov ecx, esi
call fcn.004b29d0
test al, al
je 0x417c05
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x417bec
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417c05
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00403780
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret 8

Function at 0x417d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x417d91
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x417d80
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41ac60
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41ae2d
cmp eax, 0x7c
je 0x41ae2d
cmp eax, 0x29
jne 0x41aca1
cmp dword [esi + 0x10], 0
jne 0x41ae2d
cmp eax, eax
jne 0x41aca1
test dword [esi + 0x50], 0x10000000
je 0x41ae3a
jmp 0x41ade6
cmp eax, 0x2e
jne 0x41acb5
push 5
lea ecx, [esi + 0x24]
call fcn.0041ae90
jmp 0x41ae11
cmp eax, 0x5c
jne 0x41ad11
mov ecx, esi
call fcn.0041ac00
test byte [esi + 0x50], 0x80
je 0x41ad05
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x41ace4
push 4
lea ecx, [esi + 0x24]
call fcn.0041ae90
mov ecx, esi
call fcn.0041ac00
jmp 0x41ae1f
cmp al, 0x42
jne 0x41ad05
push 4
lea ecx, [esi + 0x24]
call fcn.0041ae90
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0041ac00
jmp 0x41ae1f
mov ecx, esi
call fcn.0041c0e0
jmp 0x41ae18
cmp eax, 0x5b
jne 0x41ad72
mov ecx, esi
call fcn.0041ac00
lea ecx, [esi + 0x24]
call fcn.0041d5e0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x41ad3e
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0041ac00
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x41ad5c
cmp eax, 0x5d
jne 0x41ad5c
push eax
lea ecx, [esi + 0x24]
call fcn.0041d6c0
mov ecx, esi
call fcn.0041ac00
mov ecx, esi
call fcn.0041d060
cmp dword [esi + 0x4c], 0x5d
jne 0x41ae41
jmp 0x41ae11
cmp eax, 0x28
jne 0x41ada2
mov ecx, esi
call fcn.0041ac00
mov ecx, esi
call fcn.0041c290
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41ae3a
mov ecx, esi
call fcn.0041ac00
test bl, bl
je 0x41ae1f
jmp 0x41ae18
cmp eax, 0x5e
jne 0x41adba
push 2
lea ecx, [esi + 0x24]
call fcn.0041ae90
mov ecx, esi
call fcn.0041ac00
jmp 0x41ae1f
cmp eax, 0x24
jne 0x41add2
push 3
lea ecx, [esi + 0x24]
call fcn.0041ae90
mov ecx, esi
call fcn.0041ac00
jmp 0x41ae1f
cmp eax, 0x2a
je 0x41ae33
cmp eax, 0x2b
je 0x41ae33
cmp eax, 0x3f
je 0x41ae33
cmp eax, 0x7b
je 0x41ae33
cmp eax, 0x7d
jne 0x41adf6
test dword [esi + 0x50], 0x10000000
je 0x41ae48
jmp 0x41ae04
cmp eax, 0x5d
jne 0x41ae04
test dword [esi + 0x50], 0x10000000
je 0x41ae41
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041c4f0
mov ecx, esi
call fcn.0041ac00
mov ecx, esi
call fcn.0041c3a0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x41ac73
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.00419790
push 5
call fcn.00419790
push 4
call fcn.00419790
push 6
call fcn.00419790
int3
Function at 0x4319e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5390
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
call fcn.004cf9f0
mov bl, al
test bl, bl
je 0x431aba
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x431a28
mov eax, dword [esi]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [0x53e2d4], 0
je 0x431b7b
push 0
mov ecx, 0x53e2d0
call fcn.004413f0
mov eax, dword [0x53e2d4]
cmp byte [eax + 0x54], 0
je 0x431b7b
cmp dword [eax + 0x58], 4
jb 0x431b7b
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x14], 8
jb 0x431a95
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x431a9d
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x28]
push str.Move_File_succeed__src__s___dest__s_
push eax
call fcn.004b03c0
add esp, 0x10
push 0x1ce
jmp 0x431b40
cmp dword [0x53e2d4], 0
je 0x431b7b
push 0
mov ecx, 0x53e2d0
call fcn.004413f0
mov eax, dword [0x53e2d4]
cmp byte [eax + 0x54], 0
je 0x431b7b
cmp dword [eax + 0x58], 4
jb 0x431b7b
mov bh, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x431b20
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x431b28
mov esi, dword [esi]
push edi
push esi
lea eax, [ebp - 0x28]
push str.Move_File_failed__src__s___dest__s_
push eax
call fcn.004b03c0
add esp, 0x10
push 0x1d2
push str.RC::RCSafeUpdateUtils::MoveFileToCommonFiles
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhino_safe_src_safecommon_safeutilslibupdate_rcsafeupdateutils.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x53e2d0
push eax
push 4
call fcn.00442590
test bh, bh
je 0x431b6c
lea eax, [ebp - 0x28]
mov ecx, 0x53e2d0
push eax
call fcn.00442940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00403780
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret
Function at 0x432990
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f55cd
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x150], 0
push 1
mov dword [ebp - 0x14], 0
call fcn.004ec162
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x144]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [ebp - 0x148], 0x11c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x432a29
cmp dword [ebp - 0x144], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 1
call fcn.004bc4f0
mov dword [ebp - 0x154], eax
cmp eax, 0xffffffff
jne 0x432a62
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x150], 1
jmp 0x432b59
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.004bd140
test al, al
mov eax, dword [ebp - 0x14c]
je 0x432b05
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.004bd200
mov edi, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x432af0
mov ecx, eax
call fcn.00403780
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movq qword [ebp - 0x1c], xmm0
mov word [edi], ax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x170]
call fcn.00403780
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x432b10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00403780
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004bc3b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
ret
Function at 0x435880
Capabilities:
Delete directory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5cf8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x54
mov eax, dword [0x53e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x38], 0
je 0x4359ed
lea esi, [ecx + 0x28]
mov ecx, esi
call fcn.004b28f0
test al, al
je 0x4359ed
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x44], 0
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x44]
call fcn.004ea3e0
cmp dword [esi + 0x10], 0
je 0x4359da
push 0xffffffffffffffff
push 0x50d248
mov ecx, esi
call fcn.0040c220
cmp eax, 0xffffffff
je 0x4359da
inc eax
lea ecx, [ebp - 0x5c]
push 0xffffffffffffffff
push eax
mov edx, esi
call fcn.004b0180
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5c]
cmp dword [ebp - 0x48], 8
mov edx, str.2345hotfix
cmovae ecx, dword [ebp - 0x5c]
call fcn.004afcc0
test al, al
je 0x4359ce
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43597f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4359ce
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 5
lea edx, [ebp - 0x2c]
mov ecx, esi
call fcn.004d0280
test al, al
je 0x4359c2
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00403780
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.00403780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.004e99c0
mov al, 1
jmp 0x4359ef
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ec151
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8