joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431670
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00451a30
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43175f
mov ecx, 0x4bbfd4
lea eax, [esp]
jmp 0x4316d0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4316f0
test dl, dl
je 0x4316ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4316f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4316d0
xor eax, eax
jmp 0x4316f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x431743
mov ecx, str.FAT32
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x431721
test dl, dl
je 0x43171d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x431721
add eax, 2
add ecx, 2
test dl, dl
jne 0x431701
xor eax, eax
jmp 0x431726
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x431743
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a4b43
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a4b43
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004a4b43
add esp, 0x50c
ret 4

Function at 0x431780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043ee90
test eax, eax
je 0x4317ab
mov eax, dword [esp + 8]
test eax, eax
je 0x4317ab
cmp word [eax], 0
je 0x4317ab
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x4317c7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4317c7
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x4317d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043ee90
test eax, eax
je 0x4317f7
mov eax, dword [esp + 4]
test eax, eax
je 0x4317f7
cmp word [eax], 0
je 0x4317f7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x431860
Capabilities:
Get file attributes

Disassembly:
call fcn.0043ee90
test eax, eax
je 0x431881
mov eax, dword [esp + 8]
test eax, eax
je 0x431881
cmp word [eax], 0
je 0x431881
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x431890
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ee90
test eax, eax
je 0x4318bb
mov eax, dword [esp + 8]
test eax, eax
je 0x4318bb
cmp word [eax], 0
je 0x4318bb
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x4318d7
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x4318e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4318f0
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x43190a
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.0046db90
lea ecx, [esp + 0x10]
call fcn.0046de60
lea ecx, [esp + 0x10]
call fcn.0046dca0
mov ebp, eax
lea eax, [ebx + esi - 6]
xor edi, edi
mov dword [esp + 0x38], eax
lea ebx, [ebx + esi - 4]
lea eax, [edi + ebp]
cdq
mov ecx, 0xf4240
idiv ecx
push edx
mov edx, dword [esp + 0x3c]
push str._06u
push edx
call fcn.004a4b52
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0043ee90
test esi, esi
je 0x431978
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431978
cmp edi, 0x3e8
je 0x431984
inc edi
jmp 0x431937
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4

Function at 0x431990
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0043ee90
test eax, eax
je 0x431a1f
test esi, esi
je 0x4319db
cmp word [esi], 0
jne 0x4319e5
test edi, edi
je 0x431a1f
cmp word [edi], 0
je 0x431a1f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.00451ad0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.00451ad0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x431a27
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x1004
ret 0x10

Function at 0x431c90
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
mov ebx, dword [esp + 0xc30]
push edi
mov edi, dword [esp + 0xc30]
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00431bc0
test al, al
je 0x431cf5
call fcn.0043ee90
test eax, eax
je 0x431cee
cmp word [esp + 0x414], 0
je 0x431cee
lea edx, [esp + 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431d18
lea eax, [esp + 8]
push eax
jmp 0x431d12
call fcn.0043ee90
test eax, eax
je 0x431d11
test ebx, ebx
je 0x431d11
cmp word [ebx], 0
je 0x431d11
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431d18
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc28]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0xc24
ret 8
Function at 0x4320b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0043ee90
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x4320d8
test esi, esi
je 0x4320d8
cmp word [esi], 0
je 0x4320d8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4320e5
test edi, edi
je 0x432118
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x432103
cmp byte [esp + 0x14], 0
je 0x4320fc
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00431890
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x432118
cmp eax, 3
mov eax, 1
jne 0x43211d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x432130
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x43225d
cmp byte [ebp], 0
je 0x43225d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x4321e0
cmp byte [edi], 0x5c
jne 0x4321c2
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a64a0
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.0043ee90
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x4321b7
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.00431890
jmp 0x4321c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x50d640], 0
je 0x4321da
push edi
mov ecx, 0x50d540
call fcn.00473990
mov edi, eax
jmp 0x4321db
inc edi
cmp byte [edi], 0
jne 0x432170
cmp byte [esp + 0x420], 0
pop esi
jne 0x43223f
push ebp
call fcn.00451c80
movsx eax, byte [eax]
push eax
call fcn.00451690
test al, al
jne 0x43223f
call fcn.0043ee90
push 0
push ebp
call ebx
test eax, eax
je 0x432234
push 0
push 0
push ebp
call fcn.00431890
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a4b43
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a4b43
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a4b43
add esp, 0x408
ret 8
Function at 0x432280
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x4323b4
cmp word [ebp], 0
je 0x4323b4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x43232c
cmp word [edi + ebp], 0x5c
jne 0x432322
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a6f8f
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.0043ee90
test eax, eax
je 0x43231d
cmp word [esp + 0x14], 0
je 0x43231d
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x432317
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00431890
jmp 0x432322
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x4322c0
cmp byte [esp + 0x820], 0
pop esi
jne 0x432396
push ebp
call fcn.00451610
movzx ecx, word [eax]
push ecx
call fcn.00451690
test al, al
jne 0x432396
call fcn.0043ee90
test eax, eax
je 0x432391
cmp word [ebp], 0
je 0x432391
push 0
push ebp
call ebx
test eax, eax
je 0x43238b
push 0
push ebp
push 0
call fcn.00431890
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a4b43
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a4b43
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a4b43
add esp, 0x808
ret 8
Function at 0x432410
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0043ee90
test eax, eax
je 0x4325ae
test esi, esi
je 0x432472
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x432477
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x432485
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x43248a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43249c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x4324a1
mov byte [esp + 0x13], 0
call fcn.0043ee90
test eax, eax
je 0x4324c1
test edi, edi
je 0x4324c1
cmp word [edi], 0
je 0x4324c1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x4324cc
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4325c9
test al, 1
je 0x4325c9
push 0
push edi
push ebp
mov bl, 1
call fcn.00431890
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00451ad0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4325ae
cmp byte [esp + 0x12], 0
je 0x432536
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.0046d910
cmp byte [esp + 0x11], 0
je 0x43254b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0046d910
cmp byte [esp + 0x13], 0
je 0x432560
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.0046d910
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4325ae
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00431890
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x4324e8

Function at 0x4326d0
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ee90
test eax, eax
je 0x4326f9
mov eax, dword [esp + 8]
test eax, eax
je 0x4326f9
cmp word [eax], 0
je 0x4326f9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x432713
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x432720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432730
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, 6
ja 0x432750
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.0046db90
lea ecx, [esp + 0x10]
call fcn.0046de60
lea ecx, [esp + 0x10]
call fcn.0046dca0
mov ebp, eax
xor edi, edi
xor edx, edx
mov ecx, 0xf4240
lea eax, [edi + ebp]
div ecx
lea eax, [esi + ebx*2 - 0xc]
push edx
push 0x4bc008
push eax
mov edx, 7
call fcn.0049c820
mov edx, 0x2e
add esp, 0xc
mov word [esi + ebx*2 - 8], dx
call fcn.0043ee90
test eax, eax
je 0x4327ce
test esi, esi
je 0x4327ce
cmp word [esi], 0
je 0x4327ce
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4327ce
cmp edi, 0x3e8
je 0x4327da
inc edi
jmp 0x432771
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
Function at 0x4327f0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4b6f46
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.004633a0
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004a4c1c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x432869
mov ecx, 0x4d76b4
call fcn.00429090
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00430660
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x4e9b84], esi
je 0x4328be
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.00485ff0
mov edx, dword [0x4e9b84]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.00430d00
jmp 0x4328d4
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x4328eb
cmp dword [esp + 0xc60], eax
je 0x4328fe
cmp dword [esp + 0xc60], 0
jl 0x432903
jg 0x4328fe
cmp eax, 0x10000
jbe 0x432903
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00431010
mov edi, eax
test edi, edi
je 0x4329c8
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x432989
cmp dword [0x4e9b84], eax
je 0x432984
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004a59a0
push edx
push eax
call fcn.0046a3b0
push eax
push 0x51e
call fcn.00461310
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.0049c820
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.00486010
call fcn.004866a0
call fcn.0046b940
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.00420a10
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x4329b2
cmp dword [esp + 0xc60], eax
je 0x4328d0
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x4328d0
cmp dword [0x4e9b84], 0
je 0x4329ed
lea eax, [esp + 0x44]
push eax
call fcn.00486010
lea ecx, [esp + 0x844]
push ecx
call fcn.00485fa0
call fcn.004866a0
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x432a0a
push eax
call fcn.004a4cdf
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.004633d0
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004a4b43
add esp, 0xc40
ret 0x10
Function at 0x432a70
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x432ac8
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x432ad0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b6f96
mov eax, dword fs:[0]
push eax
mov eax, 0x1860
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x1874]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1884]
mov ebx, dword [esp + 0x1888]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
call fcn.00430310
xor ebp, ebp
mov dword [esp + 0x187c], ebp
push 1
push ebp
push ebx
push edi
lea ecx, [esp + 0x40]
call fcn.00430750
test al, al
je 0x432c1d
lea ecx, [esp + 0x30]
call fcn.00430660
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebx, edx
call fcn.004a4c1c
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebp
jne 0x432b7e
mov ecx, 0x4d76b4
call fcn.00429090
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x187c], 1
push edi
push ebp
push esi
call fcn.004a53a0
add esp, 0xc
xor edi, edi
test ebx, ebx
jl 0x432bd4
jg 0x432bb0
cmp dword [esp + 0x1c], edi
jbe 0x432bd4
jmp 0x432bb0
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.00430de0
add edi, 0x10000
adc ebp, 0
cmp ebp, ebx
jl 0x432bb0
jg 0x432bd4
cmp edi, dword [esp + 0x1c]
jb 0x432bb0
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.00430d00
lea ecx, [esp + 0x30]
call fcn.00430600
lea ecx, [esp + 0x30]
call fcn.00430390
mov byte [esp + 0x187c], 0
test esi, esi
je 0x432c15
push esi
call fcn.004a4cdf
add esp, 4
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xc50]
push ecx
lea edx, [esp + 0x1468]
push edx
call fcn.00431bc0
test al, al
je 0x432c74
call fcn.0043ee90
test eax, eax
je 0x432c5f
cmp word [esp + 0xc50], 0
je 0x432c5f
lea eax, [esp + 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x432c9e
lea ecx, [esp + 0x1464]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x432c9e
call fcn.0043ee90
test eax, eax
je 0x432c90
test ebx, ebx
je 0x432c90
cmp word [ebx], 0
je 0x432c90
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x432c97
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
mov dword [esp + 0x187c], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00430720
mov al, bl
mov ecx, dword [esp + 0x1874]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x185c]
xor ecx, esp
call fcn.004a4b43
add esp, 0x186c
ret 8
Function at 0x432ce0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4b6fe6
mov eax, dword fs:[0]
push eax
mov eax, 0x4178
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x4174], eax
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x4188]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4198]
push esi
call fcn.004519d0
test al, al
je 0x432f79
push esi
call fcn.00431420
test al, al
je 0x432f79
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x4bc014
push ecx
call fcn.004a4b52
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0x341
call fcn.00461310
push eax
lea eax, [esp + 0x3d8c]
push eax
mov edx, 0x200
call fcn.0049c820
add esp, 0xc
lea ecx, [esp + 0x3d84]
push ecx
call fcn.00486010
lea ecx, [esp + 0x10]
call fcn.0046b1a0
mov dword [esp + 0x4190], 0
lea edx, [esp + 0x3984]
push edx
lea ecx, [esp + 0x14]
call fcn.0046b240
push 2
push 0
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1568]
call fcn.00463ae0
mov byte [esp + 0x4190], 1
lea ecx, [esp + 0xccc]
call fcn.0046db90
lea ecx, [esp + 0xcf0]
call fcn.0046db90
lea ecx, [esp + 0xd14]
call fcn.0046db90
lea ecx, [esp + 0xb8]
push ecx
lea ecx, [esp + 0x155c]
call fcn.00464630
test eax, eax
jne 0x432f51
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x432f51
cmp byte [esp + 0xb9], 0x3a
jne 0x432f51
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x432e67
movsx edx, al
movzx eax, cx
cmp eax, edx
jne 0x432f51
cmp word [esp + 0x4ba], 0x3a
jne 0x432f51
call fcn.0043ee90
test eax, eax
je 0x432e89
cmp word [esp + 0x4b8], 0
je 0x432e89
push 0
lea ecx, [esp + 0x4bc]
push ecx
call edi
jmp 0x432e95
push 0
lea edx, [esp + 0xbc]
push edx
call ebp
cmp byte [esp + 0xcc8], 0
je 0x432ed3
call fcn.0043ee90
test eax, eax
je 0x432ec3
cmp word [esp + 0x4b8], 0
je 0x432ec3
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x432f35
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x432f35
call fcn.0043ee90
test eax, eax
je 0x432ef7
cmp word [esp + 0x4b8], 0
je 0x432ef7
lea edx, [esp + 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x432f05
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x432f35
lea ecx, [esp + 0x4b8]
push ecx
push 0x202
call fcn.00461310
push eax
push 0
call fcn.00493aa0
add esp, 0xc
mov ecx, 0x4d76b4
call fcn.00428fc0
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00464630
test eax, eax
je 0x432e20
mov byte [esp + 0x4190], 0
lea ecx, [esp + 0x1558]
call fcn.00463d90
mov dword [esp + 0x4190], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401ab0
mov ecx, dword [esp + 0x4188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4174]
xor ecx, esp
call fcn.004a4b43
add esp, 0x4184
ret 4