joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c78
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x18]
xor eax, eax
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 4], eax
mov edi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xorps xmm0, xmm0
lea eax, [ebp - 4]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.00433f88
mov esi, eax
test esi, esi
jns 0x425ccc
push str.Failed_to_copy_download_source_URL.
push esi
call fcn.00430a57
pop ecx
pop ecx
jmp 0x425e26
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x425d18
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x96
push str.downloadengine.cpp
call fcn.004300d9
push str.Failed_to_open_internet_session
jmp 0x425cbf
lea eax, [ebp - 8]
push eax
push 0x78
push str.DownloadTimeout
push 0x44de8c
call fcn.0043856b
mov eax, dword [ebp - 8]
test eax, eax
je 0x425d64
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 2
push edi
call esi
lea eax, [ebp - 8]
push 4
push eax
push 6
push edi
call esi
lea eax, [ebp - 8]
push 4
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 8]
lea eax, [ebp - 4]
push dword [ebx + 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004253f6
mov esi, eax
test esi, esi
jns 0x425da1
push dword [ebp - 4]
push str.Failed_to_get_size_and_time_for_URL:__ls
push esi
call fcn.00430a57
add esp, 0xc
jmp 0x425e26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x24]
call fcn.004254b6
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042515a
mov esi, eax
test esi, esi
jns 0x425e02
push dword [ebp - 4]
push str.Failed_to_download_URL:__ls
push esi
call fcn.00430a57
add esp, 0xc
jmp 0x425e17
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x425e17
xor ecx, ecx
cmp word [eax], cx
je 0x425e17
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x425e26
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x425e33
push eax
call fcn.004380ab
test edi, edi
je 0x425e3e
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 4], 0
je 0x425e4c
push dword [ebp - 4]
call fcn.004380ab
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x42d33a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0042a347
mov dword [ebp - 0x14], eax
cmp dword [0x457df4], edi
jne 0x42d42b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x42d3b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42d50b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42d50b
push 0x44fb88
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d50b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x457df4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x457df8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x457dfc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457e04], eax
test eax, eax
je 0x42d428
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457e00], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42d450
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42d443
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x42d465
push 4
pop eax
jmp 0x42d50d
cmp dword [ebp - 0x14], edi
je 0x42d465
push dword [0x457df4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42d44a
mov eax, dword [0x457e00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x42d4c3
cmp dword [0x457e04], esi
je 0x42d4c3
push eax
call ebx
push dword [0x457e04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42d4c3
test eax, eax
je 0x42d4c3
call ecx
test eax, eax
je 0x42d4b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42d4b8
test byte [ebp - 8], 1
jne 0x42d4c3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x42d4f3
mov eax, dword [0x457df8]
cmp eax, esi
je 0x42d4f0
push eax
call ebx
test eax, eax
je 0x42d4f0
call eax
mov edi, eax
test edi, edi
je 0x42d4f0
mov eax, dword [0x457dfc]
cmp eax, esi
je 0x42d4f0
push eax
call ebx
test eax, eax
je 0x42d4f0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x457df4]
call ebx
test eax, eax
je 0x42d50b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42d50d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267af
leave
ret
Function at 0x4300f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004267c0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x43018e
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x20e]
je 0x430165
push 1
push 0x452c9c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0042ff94
mov esi, eax
test esi, esi
js 0x4301c5
mov esi, 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042ffe1
mov esi, eax
test esi, esi
js 0x4301c5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x4301ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4301c5
mov esi, 0x80004005
jmp 0x4301c5
test edi, edi
je 0x4301c5
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00433f88
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267af
leave
ret 0xc
Function at 0x430b14
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [str.unknown]
push edi
mov eax, 0x104
push eax
mov dword [ebp - 0x424], eax
xor ebx, ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x418], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x208
test eax, eax
jne 0x430b78
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004267c0
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043710a
test eax, eax
jns 0x430ba2
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x430bc6
lea eax, [ebp - 0x414]
mov byte [eax], bl
inc eax
dec edi
jne 0x430bc0
push ebx
lea eax, [ebp - 0x418]
push eax
call fcn.00438acd
push dword [ebp - 0x418]
push str._Logging_started:__ls_
push 2
pop edi
push edi
call fcn.00430f28
mov ecx, dword [ebp - 0x420]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x41c]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
lea eax, [ebp - 0x20c]
push eax
push str.Executable:__ls_v_d._d._d._d
push edi
call fcn.00430f28
lea eax, [ebp - 0x414]
push eax
push str.Computer__:__ls
push edi
call fcn.00430f28
mov eax, dword [0x456ebc]
add esp, 0x34
sub eax, ebx
je 0x430c5f
dec eax
je 0x430c57
dec eax
je 0x430c4f
dec eax
je 0x430c47
dec eax
jne 0x430c65
mov esi, dword [str.debug]
jmp 0x430c65
mov esi, dword [str.verbose]
jmp 0x430c65
mov esi, dword [str.standard]
jmp 0x430c65
mov esi, dword [str.warning]
jmp 0x430c65
mov esi, dword [str.none]
push esi
push str.____logging_level:__hs____
push edi
call fcn.00430f28
add esp, 0xc
cmp dword [ebp - 0x418], 0
pop edi
pop esi
pop ebx
je 0x430c8b
push dword [ebp - 0x418]
call fcn.004380ab
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004267af
leave
ret

Function at 0x430f66
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
and dword [ebp - 4], esi
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x456eb8]
mov dword [ebp + 8], eax
cmp ecx, 0xffffffff
jne 0x430fa2
push edi
push ebx
push 0x457e84
call fcn.004341b2
mov esi, eax
test esi, esi
js 0x430ff8
xor esi, esi
jmp 0x430ff8
test eax, eax
je 0x430ff8
push 0
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x430fd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x430fe8
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp edi, eax
jae 0x430ff8
mov ecx, dword [0x456eb8]
jmp 0x430fa6
push esi
push 0x31b
push str.logutil.cpp
call fcn.004300d9
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x431510
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
test eax, eax
je 0x4315d2
cmp word [eax], cx
je 0x4315d2
push ecx
push eax
lea eax, [ebp - 4]
push eax
call fcn.00433f88
mov esi, eax
test esi, esi
js 0x43165a
lea eax, [ebp - 4]
push eax
call fcn.0043124a
mov esi, eax
test esi, esi
js 0x43165a
mov edi, dword [ebp + 0x14]
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x10], ebx
jb 0x43164d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.00433cea
mov esi, eax
add esp, 0xc
test esi, esi
js 0x431659
push dword [ebp - 8]
push dword [ebp - 4]
push str._s_s
push edi
call fcn.00433cea
mov esi, eax
add esp, 0x10
test esi, esi
js 0x431659
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43164b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x431629
inc ebx
mov esi, 0x800700b7
cmp ebx, dword [ebp + 0x10]
jbe 0x43156b
jmp 0x431659
mov edi, 0x104
push edi
lea eax, [ebp - 4]
push eax
call fcn.00433bdf
mov esi, eax
test esi, esi
js 0x43165a
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x43155b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x2d2
push str.pathutil.cpp
call fcn.004300d9
jmp 0x43165a
cmp eax, 3
jne 0x43163b
push 0
push dword [edi]
call fcn.00437850
mov esi, eax
jmp 0x43164d
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x43164d
xor esi, esi
test esi, esi
js 0x431659
push edi
call fcn.0043124a
mov esi, eax
pop ebx
cmp dword [ebp - 8], 0
je 0x431668
push dword [ebp - 8]
call fcn.004380ab
cmp dword [ebp - 4], 0
je 0x431676
push dword [ebp - 4]
call fcn.004380ab
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x431ece
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004267c0
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x43b580
cmovne eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.__ls___ls
push eax
call fcn.00433cea
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x431f80
mov cx, word [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], 0x44
push dword [ebp + 8]
mov word [ebp - 0x28], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431f75
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xa9
push str.procutil.cpp
call fcn.004300d9
jmp 0x431f80
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], ebx
mov dword [eax], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x431f93
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x431fa0
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x431fad
push dword [ebp - 4]
call fcn.004380ab
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4360f6
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
mov dword [ebp - 0x10], ebx
call fcn.00436280
cmp dword [ebp - 0x14], ebx
je 0x436132
mov dword [esi], 1
jmp 0x436166
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi], eax
test eax, eax
je 0x436166
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x436166
mov dword [esi], ebx
cmp dword [ebp - 0x10], 0
pop esi
pop ebx
je 0x436176
push dword [ebp - 0x10]
call fcn.004380ab
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004267af
leave
ret 4
Function at 0x436186
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x11c
push ebx
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004267c0
mov eax, dword [0x457f4c]
add esp, 0xc
test eax, eax
jne 0x436266
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
push 4
or ecx, eax
pop edx
mov dword [0x457f50], ecx
cmp dword [ebp - 0x11c], edx
jne 0x4361fc
xor eax, eax
inc eax
jmp 0x436261
cmp dword [ebp - 0x11c], 5
jne 0x436227
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x436213
push 2
jmp 0x436260
cmp ecx, 1
jne 0x43621c
push 3
jmp 0x436260
push 9
pop eax
cmp ecx, 2
cmove eax, edx
jmp 0x436261
cmp dword [ebp - 0x11c], 6
jne 0x43625e
cmp dword [ebp - 0x118], 0
jne 0x436247
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x436261
cmp dword [ebp - 0x118], 1
jne 0x43625e
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x436261
push 9
pop eax
mov dword [0x457f4c], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [0x457f50]
mov dword [edi], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267af
leave
ret 8
Function at 0x43659f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0042f730
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0x100c], xmm0
mov ecx, dword [ebp - 0x1008]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp - 0x100c]
mov dword [ebp - 0x1018], eax
xor esi, esi
mov dword [ebp - 0x1010], ecx
cmp dword [ebp + 0x10], 0
jne 0x4365f9
cmp dword [ebp + 0x14], 0
je 0x436610
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, edi
sbb edx, ecx
test edx, edx
jb 0x43661e
ja 0x436610
cmp eax, 0x1000
jbe 0x43661e
and dword [ebp - 0x1008], 0
mov eax, 0x1000
jmp 0x436624
mov dword [ebp - 0x1008], edx
push 0
lea ecx, [ebp - 0x1008]
push ecx
push eax
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4366a4
mov eax, dword [ebp - 0x1008]
test eax, eax
je 0x436674
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1018]
call fcn.004373a3
mov esi, eax
test esi, esi
js 0x4366d2
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1010]
add edi, eax
adc ecx, 0
mov dword [ebp - 0x1010], ecx
cmp ecx, dword [ebp + 0x14]
ja 0x436699
jb 0x436691
cmp edi, dword [ebp + 0x10]
jae 0x436699
test eax, eax
jne 0x4365ed
test ebx, ebx
je 0x4366d2
mov dword [ebx], edi
mov dword [ebx + 4], ecx
jmp 0x4366d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x40d
push str.fileutil.cpp
call fcn.004300d9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267af
leave
ret 0x14

Function at 0x4366e5
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
xor esi, esi
test edi, edi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4367bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x43672b
cmp eax, 0x50
je 0x436723
cmp eax, 0xb7
jne 0x43672b
xor esi, esi
inc esi
jmp 0x4367bc
cmp eax, 3
jne 0x4367ae
movzx eax, word [ebx]
mov edi, esi
mov ecx, ebx
test ax, ax
je 0x4367a7
push 0x5c
pop edx
cmp ax, dx
cmove edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x43673f
test edi, edi
je 0x4367a7
push esi
xor eax, eax
push ebx
mov word [edi], ax
call fcn.00437850
mov esi, eax
push 0x5c
pop eax
mov word [edi], ax
test esi, esi
js 0x4367bc
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4367bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4367bc
push esi
push 0x452
push str.fileutil.cpp
call fcn.004300d9
jmp 0x4367bc
mov esi, 0x80070003
jmp 0x4367bc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x436816
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor esi, esi
call fcn.00436af7
test eax, eax
je 0x43689d
test byte [ebp - 4], 7
push ebx
mov ebx, 0x80070000
je 0x43686b
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43686b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43686b
push esi
push 0x5c2
jmp 0x436892
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43689c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x43689c
push esi
push 0x5c8
push str.fileutil.cpp
call fcn.004300d9
pop ebx
mov eax, esi
pop esi
leave
ret 4

Function at 0x4368a4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
xor eax, eax
mov ebx, esi
inc eax
cmp dword [ebp + 0x10], ebx
cmovne ebx, eax
cmp dword [ebp + 0x14], esi
je 0x4368be
or ebx, 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4369ad
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp + 0x10], esi
jne 0x4368f6
cmp edi, 0x50
je 0x4368ee
cmp edi, 0xb7
jne 0x4368f6
xor esi, esi
inc esi
jmp 0x4369ac
cmp edi, 2
jne 0x43690f
push esi
push dword [ebp + 8]
call fcn.00436af7
test eax, eax
je 0x43699e
push 3
pop edi
cmp edi, 3
jne 0x43699e
mov eax, dword [ebp + 0xc]
mov edi, esi
movzx ecx, word [eax]
mov edx, eax
test cx, cx
je 0x436997
mov dword [ebp + 0x10], 0x5c
cmp cx, word [ebp + 0x10]
cmove edi, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x43692e
test edi, edi
je 0x436997
push esi
xor ecx, ecx
push eax
mov word [edi], cx
call fcn.00437850
mov esi, eax
mov eax, dword [ebp + 0x10]
mov word [edi], ax
test esi, esi
js 0x4369ac
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4369ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x4369ac
push esi
push 0x4d2
push str.fileutil.cpp
call fcn.004300d9
jmp 0x4369ac
mov esi, 0x80070003
jmp 0x4369ac
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10