joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432050
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0043ee10
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x432078
test esi, esi
je 0x432078
cmp word [esi], 0
je 0x432078
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x432085
test edi, edi
je 0x4320b8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4320a3
cmp byte [esp + 0x14], 0
je 0x43209c
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00431830
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4320b8
cmp eax, 3
mov eax, 1
jne 0x4320bd
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x4320d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x4321fd
cmp byte [ebp], 0
je 0x4321fd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x432180
cmp byte [edi], 0x5c
jne 0x432162
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a6510
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.0043ee10
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x432157
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.00431830
jmp 0x432162
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x50d640], 0
je 0x43217a
push edi
mov ecx, 0x50d540
call fcn.004739f0
mov edi, eax
jmp 0x43217b
inc edi
cmp byte [edi], 0
jne 0x432110
cmp byte [esp + 0x420], 0
pop esi
jne 0x4321df
push ebp
call fcn.00451c30
movsx eax, byte [eax]
push eax
call fcn.00451640
test al, al
jne 0x4321df
call fcn.0043ee10
push 0
push ebp
call ebx
test eax, eax
je 0x4321d4
push 0
push 0
push ebp
call fcn.00431830
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a4bb3
add esp, 0x408
ret 8
Function at 0x432220
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x432354
cmp word [ebp], 0
je 0x432354
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x4322cc
cmp word [edi + ebp], 0x5c
jne 0x4322c2
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a6fff
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.0043ee10
test eax, eax
je 0x4322bd
cmp word [esp + 0x14], 0
je 0x4322bd
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x4322b7
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00431830
jmp 0x4322c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x432260
cmp byte [esp + 0x820], 0
pop esi
jne 0x432336
push ebp
call fcn.004515c0
movzx ecx, word [eax]
push ecx
call fcn.00451640
test al, al
jne 0x432336
call fcn.0043ee10
test eax, eax
je 0x432331
cmp word [ebp], 0
je 0x432331
push 0
push ebp
call ebx
test eax, eax
je 0x43232b
push 0
push ebp
push 0
call fcn.00431830
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a4bb3
add esp, 0x808
ret 8
Function at 0x4323b0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0043ee10
test eax, eax
je 0x43254e
test esi, esi
je 0x432412
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x432417
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x432425
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x43242a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43243c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x432441
mov byte [esp + 0x13], 0
call fcn.0043ee10
test eax, eax
je 0x432461
test edi, edi
je 0x432461
cmp word [edi], 0
je 0x432461
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x43246c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x432569
test al, 1
je 0x432569
push 0
push edi
push ebp
mov bl, 1
call fcn.00431830
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00451a80
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43254e
cmp byte [esp + 0x12], 0
je 0x4324d6
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.0046d960
cmp byte [esp + 0x11], 0
je 0x4324eb
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0046d960
cmp byte [esp + 0x13], 0
je 0x432500
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.0046d960
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x43254e
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00431830
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4bb3
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x432488

Function at 0x432670
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ee10
test eax, eax
je 0x432699
mov eax, dword [esp + 8]
test eax, eax
je 0x432699
cmp word [eax], 0
je 0x432699
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x4326b3
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x4326c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4326d0
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, 6
ja 0x4326f0
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.0046dbe0
lea ecx, [esp + 0x10]
call fcn.0046deb0
lea ecx, [esp + 0x10]
call fcn.0046dcf0
mov ebp, eax
xor edi, edi
xor edx, edx
mov ecx, 0xf4240
lea eax, [edi + ebp]
div ecx
lea eax, [esi + ebx*2 - 0xc]
push edx
push 0x4bc008
push eax
mov edx, 7
call fcn.0049c880
mov edx, 0x2e
add esp, 0xc
mov word [esi + ebx*2 - 8], dx
call fcn.0043ee10
test eax, eax
je 0x43276e
test esi, esi
je 0x43276e
cmp word [esi], 0
je 0x43276e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x43276e
cmp edi, 0x3e8
je 0x43277a
inc edi
jmp 0x432711
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
Function at 0x432790
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4b6fa6
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.00463380
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004a4c8c
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x432809
mov ecx, 0x4d76b4
call fcn.00429090
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00430600
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x4e9b84], esi
je 0x43285e
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.00486050
mov edx, dword [0x4e9b84]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.00430ca0
jmp 0x432874
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x43288b
cmp dword [esp + 0xc60], eax
je 0x43289e
cmp dword [esp + 0xc60], 0
jl 0x4328a3
jg 0x43289e
cmp eax, 0x10000
jbe 0x4328a3
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00430fb0
mov edi, eax
test edi, edi
je 0x432968
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x432929
cmp dword [0x4e9b84], eax
je 0x432924
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004a5a10
push edx
push eax
call fcn.0046a3a0
push eax
push 0x51e
call fcn.004612e0
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.0049c880
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.00486070
call fcn.00486700
call fcn.0046b930
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.00420a10
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x432952
cmp dword [esp + 0xc60], eax
je 0x432870
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x432870
cmp dword [0x4e9b84], 0
je 0x43298d
lea eax, [esp + 0x44]
push eax
call fcn.00486070
lea ecx, [esp + 0x844]
push ecx
call fcn.00486000
call fcn.00486700
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4329aa
push eax
call fcn.004a4d4f
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.004633b0
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004a4bb3
add esp, 0xc40
ret 0x10
Function at 0x432a10
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x432a68
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x432a70
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b6ff6
mov eax, dword fs:[0]
push eax
mov eax, 0x1860
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x185c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x1874]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1884]
mov ebx, dword [esp + 0x1888]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
call fcn.004302b0
xor ebp, ebp
mov dword [esp + 0x187c], ebp
push 1
push ebp
push ebx
push edi
lea ecx, [esp + 0x40]
call fcn.004306f0
test al, al
je 0x432bbd
lea ecx, [esp + 0x30]
call fcn.00430600
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebx, edx
call fcn.004a4c8c
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebp
jne 0x432b1e
mov ecx, 0x4d76b4
call fcn.00429090
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x187c], 1
push edi
push ebp
push esi
call fcn.004a5410
add esp, 0xc
xor edi, edi
test ebx, ebx
jl 0x432b74
jg 0x432b50
cmp dword [esp + 0x1c], edi
jbe 0x432b74
jmp 0x432b50
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.00430d80
add edi, 0x10000
adc ebp, 0
cmp ebp, ebx
jl 0x432b50
jg 0x432b74
cmp edi, dword [esp + 0x1c]
jb 0x432b50
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.00430ca0
lea ecx, [esp + 0x30]
call fcn.004305a0
lea ecx, [esp + 0x30]
call fcn.00430330
mov byte [esp + 0x187c], 0
test esi, esi
je 0x432bb5
push esi
call fcn.004a4d4f
add esp, 4
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xc50]
push ecx
lea edx, [esp + 0x1468]
push edx
call fcn.00431b60
test al, al
je 0x432c14
call fcn.0043ee10
test eax, eax
je 0x432bff
cmp word [esp + 0xc50], 0
je 0x432bff
lea eax, [esp + 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x432c3e
lea ecx, [esp + 0x1464]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x432c3e
call fcn.0043ee10
test eax, eax
je 0x432c30
test ebx, ebx
je 0x432c30
cmp word [ebx], 0
je 0x432c30
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x432c37
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
mov dword [esp + 0x187c], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.004306c0
mov al, bl
mov ecx, dword [esp + 0x1874]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x185c]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x186c
ret 8
Function at 0x432c80
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4b7046
mov eax, dword fs:[0]
push eax
mov eax, 0x4178
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x4174], eax
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x4188]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4198]
push esi
call fcn.00451980
test al, al
je 0x432f19
push esi
call fcn.004313c0
test al, al
je 0x432f19
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x4bc014
push ecx
call fcn.004a4bc2
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0x341
call fcn.004612e0
push eax
lea eax, [esp + 0x3d8c]
push eax
mov edx, 0x200
call fcn.0049c880
add esp, 0xc
lea ecx, [esp + 0x3d84]
push ecx
call fcn.00486070
lea ecx, [esp + 0x10]
call fcn.0046b190
mov dword [esp + 0x4190], 0
lea edx, [esp + 0x3984]
push edx
lea ecx, [esp + 0x14]
call fcn.0046b230
push 2
push 0
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1568]
call fcn.00463ac0
mov byte [esp + 0x4190], 1
lea ecx, [esp + 0xccc]
call fcn.0046dbe0
lea ecx, [esp + 0xcf0]
call fcn.0046dbe0
lea ecx, [esp + 0xd14]
call fcn.0046dbe0
lea ecx, [esp + 0xb8]
push ecx
lea ecx, [esp + 0x155c]
call fcn.00464610
test eax, eax
jne 0x432ef1
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x432ef1
cmp byte [esp + 0xb9], 0x3a
jne 0x432ef1
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x432e07
movsx edx, al
movzx eax, cx
cmp eax, edx
jne 0x432ef1
cmp word [esp + 0x4ba], 0x3a
jne 0x432ef1
call fcn.0043ee10
test eax, eax
je 0x432e29
cmp word [esp + 0x4b8], 0
je 0x432e29
push 0
lea ecx, [esp + 0x4bc]
push ecx
call edi
jmp 0x432e35
push 0
lea edx, [esp + 0xbc]
push edx
call ebp
cmp byte [esp + 0xcc8], 0
je 0x432e73
call fcn.0043ee10
test eax, eax
je 0x432e63
cmp word [esp + 0x4b8], 0
je 0x432e63
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x432ed5
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x432ed5
call fcn.0043ee10
test eax, eax
je 0x432e97
cmp word [esp + 0x4b8], 0
je 0x432e97
lea edx, [esp + 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x432ea5
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x432ed5
lea ecx, [esp + 0x4b8]
push ecx
push 0x202
call fcn.004612e0
push eax
push 0
call fcn.00493af0
add esp, 0xc
mov ecx, 0x4d76b4
call fcn.00428fc0
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00464610
test eax, eax
je 0x432dc0
mov byte [esp + 0x4190], 0
lea ecx, [esp + 0x1558]
call fcn.00463d70
mov dword [esp + 0x4190], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401af0
mov ecx, dword [esp + 0x4188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4174]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x4184
ret 4
Function at 0x433750
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push edi
push 0x10000
call fcn.004a4c8c
mov edi, eax
add esp, 4
test edi, edi
jne 0x43376b
lea eax, [edi + 4]
pop edi
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
xor ebp, ebp
push esi
cmp ebx, 0xffffffff
je 0x433781
cmp ebp, ebx
jae 0x43380f
call fcn.00447090
cmp byte [0x4d76bc], 0
je 0x433798
cmp byte [0x4eac4c], 0
jne 0x4337dd
cmp ebx, 0xffffffff
je 0x4337a8
mov eax, ebx
sub eax, ebp
cmp eax, 0x10000
jb 0x4337ad
mov eax, 0x10000
mov ecx, dword [esp + 0x14]
push ecx
push eax
push 1
push edi
call fcn.004a68d2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4337e9
mov edx, dword [esp + 0x18]
push edx
push esi
push 1
push edi
call fcn.004a6ea4
add esp, 0x10
cmp eax, esi
jne 0x433821
add ebp, esi
jmp 0x433774
pop esi
pop ebp
pop ebx
mov eax, 9
pop edi
ret 0xc
mov eax, dword [esp + 0x14]
push eax
call fcn.004a7fe4
add esp, 4
test eax, eax
je 0x43380f
push edi
call fcn.004a4d4f
add esp, 4
pop esi
pop ebp
pop ebx
mov eax, 0xb
pop edi
ret 0xc
push edi
call fcn.004a4d4f
add esp, 4
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret 0xc
push edi
call fcn.004a4d4f
mov eax, dword [0x4d7708]
add esp, 4
push 0
push eax
push 0
push eax
mov ecx, 0x4d76b4
call fcn.00429650
pop esi
pop ebp
pop ebx
mov eax, 0xa
pop edi
ret 0xc
Function at 0x433850
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b70eb
mov eax, dword fs:[0]
push eax
mov eax, 0x1030
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x102c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x1044]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x105c]
mov ebp, dword [esp + 0x1054]
mov esi, dword [esp + 0x1058]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov ecx, ebx
mov eax, ebp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4338d0
test dl, dl
je 0x4338cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4338d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4338b0
xor eax, eax
jmp 0x4338d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x433a8c
lea eax, [esp + 0xc40]
push eax
push 0x400
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movsx ecx, byte [esp + 0xc40]
push ecx
call fcn.004a6355
add esp, 4
cmp byte [esp + 0xc40], 0x5c
mov edi, eax
je 0x433953
mov al, byte [ebx]
cmp al, 0x5c
je 0x433953
cmp byte [ebp], 0x5c
je 0x433953
movsx edx, al
push edx
call fcn.004a6355
mov esi, eax
movsx eax, byte [ebp]
push eax
call fcn.004a6355
mov cl, 0x3a
add esp, 8
cmp byte [ebx + 1], cl
je 0x43393f
mov esi, edi
cmp byte [ebp + 1], cl
je 0x433946
mov eax, edi
cmp esi, eax
mov esi, dword [esp + 0x18]
je 0x433953
mov byte [esp + 0x17], 1
push esi
push ebp
call fcn.00431720
test al, al
je 0x4339b5
lea ecx, [esp + 0x20]
call fcn.004302b0
mov dword [esp + 0x104c], 0
push 1
push 0
push esi
push ebp
lea ecx, [esp + 0x30]
call fcn.004306f0
test al, al
je 0x433a0a
lea ecx, [esp + 0x20]
call fcn.00430330
test al, al
je 0x433a0a
push esi
push ebp
call fcn.00431a10
test al, al
je 0x433a0a
mov dword [esp + 0x104c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004306c0
cmp byte [esp + 0x17], 0
jne 0x4339d3
push esi
push ebp
push 0
push ebx
call fcn.00431930
test al, al
sete al
test al, al
je 0x433a8c
push 0x4baa34
push ebx
call fcn.004a80d7
add esp, 8
mov edi, eax
push 0
test edi, edi
jne 0x433a25
mov ecx, dword [0x4d7704]
mov edx, dword [0x4d7708]
push ebx
push ecx
push edx
mov ecx, 0x4d76b4
call fcn.00429460
lea eax, [edi + 0xa]
jmp 0x433a8e
mov dword [esp + 0x104c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004306c0
mov eax, 0xf
jmp 0x433a8e
push 0x4bae08
push esi
push ebp
call fcn.00431f10
mov esi, eax
test esi, esi
jne 0x433a45
push edi
call fcn.004a6c75
add esp, 4
lea eax, [esi + 0xf]
jmp 0x433a8e
push 0
mov ecx, 0x4d76b4
call fcn.00428f40
push 0xffffffffffffffff
push esi
push edi
call fcn.00433750
push edi
mov ebx, eax
call fcn.004a6c75
add esp, 4
push 1
mov ecx, 0x4d76b4
call fcn.00428f40
push esi
call fcn.004a6c75
add esp, 4
test eax, eax
jne 0x433ab8
test ebx, ebx
jne 0x433ab8
mov eax, dword [esp + 0x1c]
push eax
call fcn.004329f0
xor eax, eax
mov ecx, dword [esp + 0x1044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x102c]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x103c
ret 0xc
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00431a10
test ebx, ebx
je 0x433ace
mov eax, ebx
cmp ebx, 0xa
jne 0x433a8e
mov eax, 0xe
jmp 0x433a8e
Function at 0x4377c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x43783b
cmp eax, 0x40
jbe 0x4377e9
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0046a240
mov dword [esi + 0x9c], 0x14
mov eax, dword [esi + 0x9c]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.004a5410
add esp, 0xc
xor eax, eax
jmp 0x437810
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x437810
push edi
lea edi, [esi + 0x40]
push edi
call fcn.0046a180
push edi
push 0x40
push esi
call fcn.0046a1c0
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x437852
mov edx, dword [esp + 8]
add esi, 0x40
push esi
push eax
push edx
call fcn.0046a1c0
pop esi
ret 0xc

Function at 0x437860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
cmp dword [esi + 0x9c], 0xffffffff
je 0x43788b
push esi
push 0
push 0
call fcn.004377c0
push edi
lea edi, [esi + 0x40]
push edi
lea eax, [esp + 0x10]
push eax
call fcn.0046a240
xor eax, eax
lea esp, [esp]
xor dword [esi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x4378a0
push edi
call fcn.0046a180
push edi
push 0x40
push esi
call fcn.0046a1c0
push edi
push 0x14
lea ecx, [esp + 0x14]
push ecx
call fcn.0046a1c0
push edi
lea edx, [esp + 0x10]
push edx
call fcn.0046a240
mov eax, dword [esp + 0x2c]
pop edi
test eax, eax
jbe 0x4378ec
push eax
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.004a5490
add esp, 0xc
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
call fcn.004a4bb3
add esp, 0x18
ret 0xc