joyce8/EMBER2024-capa huggingface dataset:
Function at 0x250ff0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], ecx
xor eax, eax
je 0x251064
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
push str.Deleting_file
push 0
push 0
push 0
push 2
push 0
push 0
lea ecx, [ebp - 0xe0]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.00224580
lea ecx, [ebp - 0x20]
call fcn.00170ca0
jmp 0x251009
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x120]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x120]
mov eax, dword [edx + 0x34]
call eax
movzx ecx, al
test ecx, ecx
jne 0x251086
xor al, al
jmp 0x2510db
lea edx, [ebp - 0xfc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x119], al
lea ecx, [ebp - 0x118]
call fcn.000b4e90
lea ecx, [ebp - 0xfc]
call fcn.00170ca0
mov al, byte [ebp - 0x119]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 4

Function at 0x2510f0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x158], ecx
xor eax, eax
je 0x251164
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
push str.Deleting_folder
push 0
push 0
push 0
push 2
push 0
push 0
lea ecx, [ebp - 0xe0]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.00224580
lea ecx, [ebp - 0x20]
call fcn.00170ca0
jmp 0x251109
lea edx, [ebp - 0xfc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
mov ecx, eax
call fcn.000ca780
sub eax, 1
push eax
push 0
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea ecx, [ebp - 0x150]
call fcn.00144dd0
lea ecx, [ebp - 0x118]
call fcn.00170ca0
lea ecx, [ebp - 0xfc]
call fcn.00170ca0
lea ecx, [ebp - 0x150]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x151], al
lea ecx, [ebp - 0x134]
call fcn.000b4e90
lea ecx, [ebp - 0x150]
call fcn.00170ca0
mov al, byte [ebp - 0x151]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 4
Function at 0x251210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
lea eax, [ebp - 0x238]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x251246
xor al, al
jmp 0x251357
call fcn.00252470
movzx ecx, al
test ecx, ecx
jne 0x251276
push 0x105
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x251276
xor al, al
jmp 0x251357
lea ecx, [ebp - 0x238]
push ecx
call fcn.00252450
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jbe 0x2512c7
mov edx, dword [ebp - 0x24]
movzx eax, word [ebp + edx*2 - 0x23a]
cmp eax, 0x5c
je 0x2512c7
push 0xffffffffffffffff
push 0x27e90c
mov ecx, 0x105
sub ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x24]
lea eax, [ebp + edx*2 - 0x238]
push eax
call fcn.00252500
add esp, 0x10
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x104
jb 0x2512d7
xor al, al
jmp 0x251357
mov ecx, dword [ebp + 8]
call fcn.00248b20
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0024a380
add esp, 8
push eax
mov ecx, dword [ebp + 8]
call fcn.00248f80
lea ecx, [ebp - 0x20]
call fcn.00170ca0
cmp dword [ebp + 0x10], 0
je 0x251315
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00248fe0
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x251347
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x23c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x23c]
mov eax, dword [edx + 0x20]
call eax
movzx ecx, al
test ecx, ecx
jne 0x251347
mov dword [ebp - 0x240], 0
jmp 0x251351
mov dword [ebp - 0x240], 1
mov al, byte [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 0xc

Function at 0x251370
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x268], ecx
lea eax, [ebp - 0x260]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x261], al
lea ecx, [ebp - 0x58]
call fcn.000b4e90
lea ecx, [ebp - 0x3c]
call fcn.00170ca0
lea ecx, [ebp - 0x20]
call fcn.000b4e90
movzx edx, byte [ebp - 0x261]
test edx, edx
je 0x251418
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0024a380
add esp, 8
mov eax, dword [ebp + 8]
jmp 0x251428
push 0x27e4e2
mov ecx, dword [ebp + 8]
call fcn.000b6550
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 0xc
Function at 0x251440
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x178], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x178]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x178]
mov eax, dword [edx + 0x34]
call eax
movzx ecx, al
test ecx, ecx
jne 0x25147e
xor al, al
jmp 0x25159e
xor edx, edx
je 0x25150c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
push 0x27ebac
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
push 0x27e9ac
push 0
push 0
push 0
push 2
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
lea ecx, [ebp - 0x100]
call fcn.00224580
lea ecx, [ebp - 0x3c]
call fcn.00170ca0
lea ecx, [ebp - 0x20]
call fcn.00170ca0
jmp 0x25147e
lea edx, [ebp - 0x11c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
lea ecx, [ebp - 0x154]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea edx, [ebp - 0x170]
push edx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x171], al
lea ecx, [ebp - 0x170]
call fcn.000b4e90
lea ecx, [ebp - 0x154]
call fcn.00170ca0
lea ecx, [ebp - 0x138]
call fcn.000b4e90
lea ecx, [ebp - 0x11c]
call fcn.00170ca0
mov al, byte [ebp - 0x171]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 8
Function at 0x2515b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x238]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x238]
mov eax, dword [edx + 0x30]
call eax
movzx ecx, al
test ecx, ecx
jne 0x2515ee
xor al, al
jmp 0x2517b1
xor edx, edx
je 0x25167c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
push str._to
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
push str.Moving
push 0
push 0
push 0
push 2
push 0
push 0
lea ecx, [ebp - 0x100]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b9f20
add esp, 8
lea ecx, [ebp - 0x100]
call fcn.00224580
lea ecx, [ebp - 0x3c]
call fcn.00170ca0
lea ecx, [ebp - 0x20]
call fcn.00170ca0
jmp 0x2515ee
lea edx, [ebp - 0x11c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
lea ecx, [ebp - 0x154]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea edx, [ebp - 0x170]
push edx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x231], al
lea ecx, [ebp - 0x170]
call fcn.000b4e90
lea ecx, [ebp - 0x154]
call fcn.00170ca0
lea ecx, [ebp - 0x138]
call fcn.000b4e90
lea ecx, [ebp - 0x11c]
call fcn.00170ca0
movzx eax, byte [ebp - 0x231]
test eax, eax
je 0x2517af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x11
je 0x25176f
xor ecx, ecx
je 0x25176b
push str.Failed_to_move_file
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 4
push 0x10e
push 0x27ebc0
lea ecx, [ebp - 0x230]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
lea ecx, [ebp - 0x230]
call fcn.00224580
jmp 0x251723
xor al, al
jmp 0x2517b1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x238]
call fcn.00249710
movzx ecx, al
test ecx, ecx
jne 0x25178d
xor al, al
jmp 0x2517b1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x238]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x238]
mov eax, dword [edx + 0x1c]
call eax
movzx ecx, al
test ecx, ecx
jne 0x2517af
xor al, al
jmp 0x2517b1
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 8
Function at 0x251930
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x60]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x65], al
lea ecx, [ebp - 0x3c]
call fcn.000b4e90
lea ecx, [ebp - 0x20]
call fcn.00170ca0
movzx ecx, byte [ebp - 0x65]
test ecx, ecx
je 0x2519b6
xor al, al
jmp 0x2519de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
je 0x2519d4
cmp dword [ebp - 0x64], 3
je 0x2519d4
mov dword [ebp - 0x70], 0
jmp 0x2519db
mov dword [ebp - 0x70], 1
mov al, byte [ebp - 0x70]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 4

Function at 0x2519f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00248bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
lea edx, [ebp - 0x58]
push edx
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x75], al
lea ecx, [ebp - 0x74]
call fcn.000b4e90
lea ecx, [ebp - 0x58]
call fcn.00170ca0
lea ecx, [ebp - 0x3c]
call fcn.000b4e90
lea ecx, [ebp - 0x20]
call fcn.00170ca0
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 8
Function at 0x251a90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], ecx
lea eax, [ebp - 0x250]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x251ac6
xor al, al
jmp 0x251b56
call fcn.00252470
movzx ecx, al
test ecx, ecx
jne 0x251af3
push 0x105
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x251af3
xor al, al
jmp 0x251b56
lea ecx, [ebp - 0x250]
push ecx
call fcn.00252450
add esp, 4
push eax
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.00248bb0
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
call fcn.002524b0
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x251], al
lea ecx, [ebp - 0x3c]
call fcn.000b4e90
lea ecx, [ebp - 0x20]
call fcn.00170ca0
mov al, byte [ebp - 0x251]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 4
Function at 0x251d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x274], ecx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff9
add eax, 0x23
mov dword [ebp - 0x5c], eax
push 1
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x251dca
xor al, al
jmp 0x251f7a
call fcn.00252470
movzx eax, al
test eax, eax
jne 0x251dfa
push 0x105
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x251dfa
xor al, al
jmp 0x251f7a
push 0xffffffffffffffff
push 0x27ea6c
push 0x105
lea eax, [ebp - 0x270]
push eax
call fcn.00252570
add esp, 0x10
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x274]
add ecx, 4
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00252500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x20]
call fcn.000b4e90
cmp dword [ebp - 0x60], 0
jbe 0x251ea1
mov eax, dword [ebp - 0x60]
movzx ecx, word [ebp + eax*2 - 0x272]
cmp ecx, 0x5c
je 0x251ea1
push 0xffffffffffffffff
push 0x27eb0c
mov edx, 0x105
sub edx, dword [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x60]
lea ecx, [ebp + eax*2 - 0x270]
push ecx
call fcn.00252500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x274]
add edx, 0x20
push edx
lea eax, [ebp - 0x3c]
push eax
call fcn.0021d370
add esp, 8
mov ecx, eax
call fcn.000b4c40
push eax
mov ecx, 0x105
sub ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x60]
lea eax, [ebp + edx*2 - 0x270]
push eax
call fcn.00252500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
call fcn.000b4e90
cmp dword [ebp - 0x60], 0
jbe 0x251f2a
mov ecx, dword [ebp - 0x60]
movzx edx, word [ebp + ecx*2 - 0x272]
cmp edx, 0x5c
je 0x251f2a
push 0xffffffffffffffff
push 0x27ebbc
mov eax, 0x105
sub eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
lea edx, [ebp + ecx*2 - 0x270]
push edx
call fcn.00252500
add esp, 0x10
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x104
jb 0x251f37
xor al, al
jmp 0x251f7a
mov ecx, dword [ebp + 8]
call fcn.00248b20
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0024a380
add esp, 8
push eax
mov ecx, dword [ebp + 8]
call fcn.00248f80
lea ecx, [ebp - 0x58]
call fcn.00170ca0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x274]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x274]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 8
Function at 0x252000
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp + 0xc], 0
jne 0x252026
xor al, al
jmp 0x25223c
lea ecx, [ebp - 0x218]
call fcn.000b50e0
mov dword [ebp - 0x1fc], 0
push 4
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.00249310
movzx ecx, al
test ecx, ecx
je 0x2520a1
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x20]
call fcn.000b6550
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0021d370
add esp, 8
push eax
lea ecx, [ebp - 0x218]
call fcn.000bfd10
lea ecx, [ebp - 0x3c]
call fcn.000b4e90
lea ecx, [ebp - 0x20]
call fcn.00170ca0
lea ecx, [ebp - 0x218]
call fcn.000b4c40
mov dword [ebp - 0x1fc], eax
jmp 0x252108
push 0x27ec5c
push 2
push 0
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 8]
call fcn.00248e60
mov ecx, eax
call fcn.000bb350
push eax
call fcn.000be3d0
add esp, 8
mov byte [ebp - 0x231], al
lea ecx, [ebp - 0x74]
call fcn.00170ca0
lea ecx, [ebp - 0x58]
call fcn.00170ca0
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
je 0x252108
mov byte [ebp - 0x232], 0
lea ecx, [ebp - 0x218]
call fcn.000b4e90
mov al, byte [ebp - 0x232]
jmp 0x25223c
mov edx, dword [ebp - 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
and eax, 4
jne 0x252131
mov ecx, dword [ebp - 0x228]
and ecx, 0
je 0x25219b
xor edx, edx
je 0x25217e
lea eax, [ebp - 0x224]
push eax
push str._remove_or_unknown_drive
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x138]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
push eax
call fcn.000b16a0
add esp, 8
lea ecx, [ebp - 0x138]
call fcn.00224580
jmp 0x252131
mov byte [ebp - 0x233], 0
lea ecx, [ebp - 0x218]
call fcn.000b4e90
mov al, byte [ebp - 0x233]
jmp 0x25223c
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x2521da
mov byte [ebp - 0x234], 1
lea ecx, [ebp - 0x218]
call fcn.000b4e90
mov al, byte [ebp - 0x234]
jmp 0x25223c
xor edx, edx
je 0x252217
push str._GetDiskFreeSpaceEx_returns_error
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
lea ecx, [ebp - 0x1f8]
call fcn.00224580
jmp 0x2521da
mov byte [ebp - 0x235], 0
lea ecx, [ebp - 0x218]
call fcn.000b4e90
mov al, byte [ebp - 0x235]
jmp 0x25223c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 8
Function at 0x252250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x2d16ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x154], ecx
lea ecx, [ebp - 0x140]
call fcn.002489b0
mov dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.0023b8e0
lea ecx, [ebp - 0x144]
call fcn.0021da50
push eax
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x252328
xor ecx, ecx
je 0x2522fb
push str.::GetCurrentDirectory___failed
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 4
push 0x1c0
push str.P:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclient_third_partylibjingle_files_talk_basewin32filesystem.cc
lea ecx, [ebp - 0xc8]
call fcn.00224170
mov ecx, eax
call fcn.0021f550
push eax
call fcn.000b16a0
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.00224580
jmp 0x2522b3
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp + 8]
call fcn.00252400
lea ecx, [ebp - 0x144]
call fcn.002524d0
lea ecx, [ebp - 0x140]
call fcn.0023f370
mov eax, dword [ebp + 8]
jmp 0x2523e2
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x148]
jg 0x252338
jmp 0x252388
xor ecx, ecx
mov eax, dword [ebp - 0x14c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.001f7a7c
add esp, 4
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0x144]
call fcn.0021da10
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x148], ecx
mov edx, 1
test edx, edx
jne 0x25228b
lea ecx, [ebp - 0x144]
call fcn.0021da50
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.0024a380
add esp, 8
push eax
lea ecx, [ebp - 0x140]
call fcn.00248f80
lea ecx, [ebp - 0xe4]
call fcn.00170ca0
lea ecx, [ebp - 0x140]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00252400
lea ecx, [ebp - 0x144]
call fcn.002524d0
lea ecx, [ebp - 0x140]
call fcn.0023f370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.001f8a41
mov esp, ebp
pop ebp
ret 4

Function at 0x253a45
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x253a6c
call fcn.001faeef
mov dword [eax], esi
call fcn.001faedc
push 0x16
pop esi
mov dword [eax], esi
call fcn.001f8cab
mov eax, esi
jmp 0x253ac1
test dword [ebp + 0xc], 0xfffffff9
jne 0x253a52
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x253a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.001faf02
pop ecx
call fcn.001faedc
mov eax, dword [eax]
jmp 0x253ac1
test al, 0x10
jne 0x253abf
test al, 1
je 0x253abf
test byte [ebp + 0xc], 2
je 0x253abf
call fcn.001faeef
mov dword [eax], 5
call fcn.001faedc
mov dword [eax], 0xd
jmp 0x253a90
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4097ac
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
jmp 0x409855
cmp dword [esi + 0x10], 0x1000
jne 0x409841
test byte [esi + 0x15], 1
jne 0x409841
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409800
cmp eax, 2
je 0x409800
cmp eax, 0x10
je 0x409800
cmp eax, 0x20
jne 0x409815
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409815
mov bl, 1
xor ebp, ebp
jmp 0x409826
mov eax, dword [esi]
add eax, ebp
call fcn.004097a4
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409819
test bl, bl
je 0x409841
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409860
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097d8
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x19727b8a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x7219789f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219