joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10129270
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x101292c1
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x101292c1
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x101292c1
xor eax, eax
jmp 0x10129302
mov dword [ebp - 8], 1
jmp 0x101292d3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x101292fd
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x101292fb
xor eax, eax
jmp 0x10129302
jmp 0x101292ca
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10140750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x1014076e
cmp dword [ebp + 0xc], 0
jne 0x10140773
jmp 0x10140810
mov ecx, dword [0x101d84d0]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x64]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, word [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10140810
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
push 4
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.1012a000
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.100e6d00
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
call fcn.10129b20
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x10142920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x10142944
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jae 0x10142965
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x1014293b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10154970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0x5c]
call fcn.1001a6b0
mov cl, byte [esp + 0x5c]
mov byte [esp + 4], cl
movzx edx, byte [esp + 4]
test edx, edx
je 0x10154ac0
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [esp + 8]
add edx, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
push ecx
call fcn.1006df00
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x38]
call fcn.10002730
mov dl, byte [esp + 7]
mov byte [esp + 3], dl
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov eax, dword [esp + 8]
mov cl, byte [eax + edx + 0x40]
mov byte [esp + 3], cl
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [esp + 8]
add ecx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 8]
mov eax, dword [edx + ecx + 0x38]
mov dword [esp + 0x24], eax
mov byte [esp + 0x40], 0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
mov dword [esp + 0x2c], edx
cvtss2sd xmm0, dword [ebp + 8]
sub esp, 8
movsd qword [esp], xmm0
movzx eax, byte [esp + 0xb]
push eax
mov ecx, dword [esp + 0x34]
push ecx
mov edx, dword [esp + 0x64]
push edx
mov eax, dword [esp + 0x64]
push eax
lea ecx, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x30]
call dword [esp + 0x48]
mov dl, byte [esp + 0x60]
mov byte [esp + 5], dl
movzx eax, byte [esp + 5]
test eax, eax
je 0x10154ac0
mov ecx, dword [esp + 0xc]
or ecx, 4
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [esp + 8]
add ecx, dword [eax + 4]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x30], eax
mov byte [esp + 6], 0
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x38], 0
je 0x10154af5
mov dword [esp + 0x18], 0
jmp 0x10154afd
mov dword [esp + 0x18], 4
mov edx, dword [esp + 0x30]
or edx, dword [esp + 0xc]
or edx, dword [esp + 0x18]
movzx eax, byte [esp + 6]
push eax
push edx
mov ecx, dword [esp + 0x18]
call fcn.10002cd0
mov ecx, dword [esp + 8]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x58]
call fcn.1001a650
mov eax, dword [esp + 0x34]
mov esp, ebp
pop ebp
ret 4
Function at 0x101601f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 8], ecx
mov eax, dword [0x101d96d0]
cmp dword [eax], 0
je 0x1016020d
mov dword [ebp - 0x10], 1
jmp 0x10160214
mov dword [ebp - 0x10], 0
movzx ecx, byte [ebp - 0x10]
test ecx, ecx
jne 0x10160221
jmp 0x1016030d
cmp dword [ebp - 8], 0
je 0x1016030d
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [edx + ecx]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 8]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x811c9dc5
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x10160285
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x10160254
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x1b30ddf0
je 0x101602d7
cmp dword [ebp - 0x14], 0x78a2d0fe
je 0x1016029f
jmp 0x1016030d
mov eax, dword [0x101d96d0]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.1005ad50
mov esi, eax
push 0
push str.userid
mov ecx, dword [ebp - 8]
call fcn.1005aef0
cmp esi, eax
jne 0x101602d5
mov edx, dword [0x101dfa00]
add edx, 1
mov dword [0x101dfa00], edx
jmp 0x1016030d
mov eax, dword [0x101d96d0]
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call fcn.1005ad50
mov esi, eax
push 0
push str.attacker
mov ecx, dword [ebp - 8]
call fcn.1005aef0
cmp esi, eax
jne 0x1016030d
mov edx, dword [0x101df9f8]
add edx, 1
mov dword [0x101df9f8], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10164230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
push str.CreateInterface
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1016427b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1016427b
mov eax, dword [ebp - 8]
jmp 0x101642da
push 0x10
push str.NEPS.PP
push str._interface_
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x5c]
call fcn.10012e10
push eax
mov edx, str.Failed_to_find
lea ecx, [ebp - 0x44]
call fcn.1001bb60
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.1001bbc0
mov ecx, eax
call fcn.10012c50
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x2c]
call fcn.10012cd0
lea ecx, [ebp - 0x44]
call fcn.10012cd0
lea ecx, [ebp - 0x5c]
call fcn.10012cd0
push 1
call fcn.1017b6d9
mov esp, ebp
pop ebp
ret
Function at 0x10169a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov dword [esp + 4], ecx
mov eax, 4
imul ecx, eax, 0x11c
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov ecx, dword [ecx + eax]
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x70]
push edx
mov ecx, dword [esp + 8]
call dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov ecx, dword [0x101d84b8]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x38]
mov dword [esp + 0x20], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x48], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x4c], eax
mov ecx, dword [ecx + 8]
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x58], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x60], ecx
push 1
sub esp, 0xc
mov edx, esp
mov eax, dword [esp + 0x58]
mov dword [edx], eax
mov ecx, dword [esp + 0x5c]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x60]
mov dword [edx + 8], eax
sub esp, 0xc
mov ecx, esp
mov edx, dword [esp + 0x74]
mov dword [ecx], edx
mov eax, dword [esp + 0x78]
mov dword [ecx + 4], eax
mov edx, dword [esp + 0x7c]
mov dword [ecx + 8], edx
call dword [esp + 0x3c]
add esp, 0x1c
movzx eax, al
test eax, eax
je 0x10169b46
xor al, al
jmp 0x10169bd7
mov ecx, dword [0x101d84c4]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x68], 0x101a2e30
mov ecx, dword [esp + 4]
mov dword [esp + 0x6c], ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xe0]
call fcn.1003f9e0
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0x46004009
lea eax, [esp + 0xe4]
push eax
mov ecx, dword [esp + 0x38]
call fcn.1003fb20
mov ecx, dword [esp + 0xcc]
cmp ecx, dword [ebp + 8]
je 0x10169bcb
movss xmm0, dword [esp + 0xac]
comiss xmm0, dword [0x101ca360]
ja 0x10169bcb
mov dword [esp + 8], 0
jmp 0x10169bd3
mov dword [esp + 8], 1
mov al, byte [esp + 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x101807e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1018065f

Function at 0x101882f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10187f70
Function at 0x405380
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x5304cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x405441
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00475d80
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40542b
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.00475d80
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push 0x4f8900
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x405441
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468d78
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00475d80
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.00405510
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00490d71
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x4054a1
cmp eax, 0x207
ja 0x4054a1
jne 0x4054a8
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4054b1
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00468d78
mov esp, ebp
pop ebp
ret
Function at 0x407b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407bb9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407bb9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x407baa
cmp esi, edx
jae 0x407bb9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x407b98
cmp esi, edx
jae 0x407bb9
cmp word [esi], 0
je 0x407bb9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x408500
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004691e0
mov eax, dword [0x5304cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x408530
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468d78
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.00475d80
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.00492052
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00468d78
mov esp, ebp
pop ebp
ret
Function at 0x4085c0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x5304cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4087d3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4087d3
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4085f3
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4087d3
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.00475d80
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00475d80
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x4f8c6c
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408674
test al, 1
je 0x408674
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x4087b9
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4087ad
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x408728
cmp word [ebp - 0x638], 0x2e
jne 0x4086e7
mov ax, word [ebp - 0x636]
test ax, ax
je 0x408792
cmp ax, 0x2e
jne 0x4086e7
cmp word [ebp - 0x634], 0
je 0x408792
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00475d80
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.004085c0
add esp, 4
jmp 0x408790
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00475d80
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40877f
test al, 1
je 0x40877f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4086b0
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00468d78
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00468d78
mov esp, ebp
pop ebp
ret
Function at 0x4087f0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408848
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408848
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x408828
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408848
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408843
test al, 0x10
je 0x408843
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x408848
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x408fe0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40900f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.00429bb0
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409007
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x409035
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408ff2
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x409050
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9956
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x5304cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40908c
xor eax, eax
jmp 0x409292
cmp word [ebx], 0
je 0x409085
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409097
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x409085
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00475d80
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x4f8cec
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4090f2
test al, 1
je 0x4090f2
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 0x5c
mov dword [ebp - 0x428], 0
mov word [ebp - 0x42c], ax
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x884]
call fcn.00408850
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x409242
cmp dword [ebp - 0x424], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0x4091a1
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x4091a1
cmp word [ebp - 0x858], 0x2e
jne 0x4091a1
mov ax, word [ebp - 0x856]
test ax, ax
je 0x40917c
cmp ax, 0x2e
jne 0x4091a1
cmp word [ebp - 0x854], 0
jne 0x4091a1
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x4092ae
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
jmp 0x409234
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x884]
call fcn.00408a40
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
je 0x4091dc
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x4091dc
mov esi, dword [ebp - 0x888]
push esi
call fcn.00409050
jmp 0x4091e8
mov esi, dword [ebp - 0x888]
push esi
call fcn.00408fe0
mov eax, dword [ebp - 0x428]
add esp, 4
test eax, eax
jne 0x4091f9
xor edi, edi
jmp 0x409218
cmp dword [ebp - 0x424], 0
jne 0x409206
xor edi, edi
jmp 0x409218
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x409234
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x409139
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x424], 0
test eax, eax
je 0x409268
cmp eax, 0xffffffff
je 0x409268
push eax
call esi
mov dword [ebp - 0x428], 0
push ebx
call fcn.00408500
mov eax, dword [ebp - 0x428]
add esp, 4
mov dword [ebp - 0x424], 0
test eax, eax
je 0x40928d
cmp eax, 0xffffffff
je 0x40928d
push eax
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d78
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x424], 0
jmp 0x409268