joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410310
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69da8d
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x634]
push edx
push str._s_mac_s
lea eax, [ebp - 0x414]
push eax
call fcn.0066926d
add esp, 0x10
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x62c], 0
push 0x103
push 0
lea ecx, [ebp - 0x62b]
push ecx
call fcn.006665c0
add esp, 0xc
lea edx, [ebp - 0x62c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov byte [ebp - 0x524], 0
push 0x103
push 0
lea eax, [ebp - 0x523]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x524]
push ecx
call fcn.006665c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x524]
push edx
call fcn.0049f360
add esp, 8
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x418]
call fcn.0040dbe0
mov dword [ebp - 4], 0
push str._binCoreChips
lea ecx, [ebp - 0x418]
push ecx
call fcn.0040e0f0
add esp, 8
push 0
lea ecx, [ebp - 0x418]
call fcn.004018a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x6c8130
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp - 0x634]
call fcn.00410810
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x630], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.004014d0
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x41a150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x41a169
cmp dword [ebp + 0xc], 0
je 0x41a169
cmp dword [ebp + 0x10], 0
jne 0x41a17b
push str.param_error_filepath_or_reboot_or_multi_is_null.
call fcn.0066610b
add esp, 4
or eax, 0xffffffff
jmp 0x41a1f8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x41c200
push 0
push 0
call fcn.0066a64b
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x41a1f2
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c480
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41c4ce
xor eax, eax
jmp 0x41c528
mov edx, 1
test edx, edx
je 0x41c51b
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41c4f7
jmp 0x41c51b
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.0066a2f0
add esp, 8
test eax, eax
jne 0x41c519
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
jmp 0x41c51b
jmp 0x41c4ce
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x41d850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x41d890
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x41d89c
mov al, 1
jmp 0x41da3f
mov dword [ebp - 0x10], 8
call fcn.00405060
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00405060
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00405040
add esp, 8
movzx eax, al
test eax, eax
je 0x41d8df
xor al, al
jmp 0x41da3f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0041d550
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.0041c650
mov ecx, eax
call fcn.00406590
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00407790
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041c650
mov ecx, eax
call fcn.00406590
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.0041df90
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x41d95a
cmp dword [ebp - 0x5c], 1
je 0x41d961
cmp dword [ebp - 0x5c], 3
je 0x41d9fb
jmp 0x41da13
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0041c650
mov ecx, eax
call fcn.00406590
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x41d9c4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041c650
mov ecx, eax
call fcn.00406590
push eax
call fcn.00669854
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x41d9c4
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404770
mov al, byte [ebp - 0x51]
jmp 0x41da3f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x41d9e7
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404770
mov al, byte [ebp - 0x52]
jmp 0x41da3f
cmp dword [ebp - 0x38], 0
jne 0x41d9f9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040ca40
jmp 0x41da2b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404770
mov al, byte [ebp - 0x53]
jmp 0x41da3f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00404770
mov al, byte [ebp - 0x54]
jmp 0x41da3f
jmp 0x41d8f2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x45fc40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4243
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
call fcn.00455110
lea ecx, [ebp + 8]
call fcn.00489570
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45fcbd
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014d0
mov eax, dword [ebp - 0x11c]
jmp 0x45fde3
push 0x6ea31c
lea ecx, [ebp + 8]
call fcn.00489570
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
push eax
call fcn.0066b830
add esp, 4
test eax, eax
jne 0x45fdb5
push 0xff
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.006665c0
add esp, 0xc
mov edx, dword [ebp - 0x118]
push edx
push 0xff
lea eax, [ebp - 0x114]
push eax
call fcn.0066b6f8
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
call fcn.00666cf0
add esp, 4
test eax, eax
jbe 0x45fdb0
push 0x6ea320
lea edx, [ebp - 0x114]
push edx
call fcn.00404520
add esp, 8
test eax, eax
jne 0x45fd64
push str.prodnv
lea eax, [ebp - 0x114]
push eax
call fcn.00404520
add esp, 8
test eax, eax
je 0x45fd7c
push str.reboot_bootloader
lea ecx, [ebp - 0x114]
push ecx
call fcn.00404520
add esp, 8
test eax, eax
je 0x45fdb0
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x120]
call fcn.0040dbe0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00454fa0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.004014d0
jmp 0x45fcd9
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004014d0
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 8
Function at 0x46a350
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4a3d
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x634]
mov eax, dword [edx + 0x104]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
push str._s__d_115200__s
lea edx, [ebp - 0x414]
push edx
call fcn.0066926d
add esp, 0x14
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x62c], 0
push 0x103
push 0
lea eax, [ebp - 0x62b]
push eax
call fcn.006665c0
add esp, 0xc
lea ecx, [ebp - 0x62c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov byte [ebp - 0x524], 0
push 0x103
push 0
lea edx, [ebp - 0x523]
push edx
call fcn.006665c0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x524]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x524]
push ecx
call fcn.0049f360
add esp, 8
lea edx, [ebp - 0x524]
push edx
lea ecx, [ebp - 0x418]
call fcn.0040dbe0
mov dword [ebp - 4], 0
push str._binQMulti_DL_CMD
lea eax, [ebp - 0x418]
push eax
call fcn.0040e0f0
add esp, 8
push 0
lea ecx, [ebp - 0x418]
call fcn.004018a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x6eef84
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x634]
call fcn.0046a500
mov dword [ebp - 0x41c], eax
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.004014d0
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x46d330
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x634], ecx
mov byte [ebp - 0x414], 0
push 0x3ff
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.006665c0
add esp, 0xc
mov ecx, dword [ebp - 0x634]
add ecx, 0x104
push ecx
call fcn.00666cf0
add esp, 4
cmp eax, 2
jbe 0x46d3e4
mov edx, dword [ebp - 0x634]
movsx eax, byte [edx + 0x105]
cmp eax, 0x2c
jne 0x46d3e4
mov ecx, dword [ebp - 0x634]
mov byte [ecx + 0x106], 0x2d
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x634]
add eax, 0x104
push eax
mov ecx, dword [ebp - 0x634]
push ecx
push str._s_mode1_com_s_boot__s_
lea edx, [ebp - 0x414]
push edx
call fcn.0066926d
add esp, 0x14
jmp 0x46d403
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
push str._s_mode2_boot__s_
lea edx, [ebp - 0x414]
push edx
call fcn.0066926d
add esp, 0x10
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x62c], 0
push 0x103
push 0
lea eax, [ebp - 0x62b]
push eax
call fcn.006665c0
add esp, 0xc
lea ecx, [ebp - 0x62c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov byte [ebp - 0x524], 0
push 0x103
push 0
lea edx, [ebp - 0x523]
push edx
call fcn.006665c0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x524]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x524]
push ecx
call fcn.0049f360
add esp, 8
lea edx, [ebp - 0x524]
push edx
lea ecx, [ebp - 0x418]
call fcn.0040dbe0
mov dword [ebp - 4], 0
push str._binSSD222D
lea eax, [ebp - 0x418]
push eax
call fcn.0040e0f0
add esp, 8
push 0
lea ecx, [ebp - 0x418]
call fcn.004018a0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x6f79e0
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x634]
call fcn.0046d530
mov dword [ebp - 0x41c], eax
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x630], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.004014d0
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x472830
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x4759a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a531e
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xec], ecx
mov eax, dword [0x6c2cb8]
push eax
push 0x70a340
mov ecx, dword [ebp + 8]
call fcn.004129c0
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [0x6c2cb8]
je 0x475a43
mov edx, dword [0x6c2cb8]
push edx
mov eax, dword [ebp - 0x50]
add eax, 1
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004129f0
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
mov dword [ebp - 0xf4], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404770
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xec]
add edx, 0x34
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.00477630
add esp, 0xc
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0xfc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00404770
push 0x70a344
mov ecx, dword [ebp + 8]
call fcn.00404810
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x475b2c
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.00669854
add esp, 0x10
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00669ba2
add esp, 4
lea ecx, [ebp - 0xe4]
call fcn.00476760
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.004047d0
lea edx, [ebp - 0xe4]
push edx
mov ecx, dword [ebp - 0xec]
add ecx, 0x24
call fcn.00476b60
mov byte [ebp - 0xe5], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.004767c0
mov al, byte [ebp - 0xe5]
jmp 0x475b2e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475b50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a5361
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20c], ecx
mov byte [ebp - 0x154], 0
push 0x103
push 0
lea eax, [ebp - 0x153]
push eax
call fcn.006665c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x154]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.004047f0
mov eax, dword [0x6c2cb8]
push eax
push 0x70a348
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.004129c0
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [0x6c2cb8]
je 0x475c4f
mov edx, dword [ebp - 0x208]
add edx, 1
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.004129f0
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.00404740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404770
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.00405300
movzx eax, al
test eax, eax
je 0x475c77
push 0x70a34c
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.004047f0
lea ecx, [ebp - 0x15c]
push ecx
call fcn.00475da0
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x204]
call fcn.00470ce0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x204]
test edx, edx
je 0x475cb7
lea eax, [ebp - 0x204]
add eax, 0x10
mov dword [ebp - 0x218], eax
jmp 0x475cc1
mov dword [ebp - 0x218], 0
push 0x70a350
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x15c]
push edx
push str.IOT_OTA_Package
mov eax, dword [ebp - 0x20c]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x218]
push ecx
call fcn.0040a680
add esp, 8
push eax
call fcn.0040a270
add esp, 8
mov ecx, eax
call fcn.00476920
push eax
call fcn.0040a270
add esp, 8
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x204]
call fcn.004055d0
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.00404740
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00404770
push 0
mov ecx, dword [ebp - 0x20c]
add ecx, 0x34
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.004043b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x475dc0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x475ddb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, 0x24
call fcn.00476b20
cmp dword [ebp - 4], eax
jae 0x475e0a
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x24
call fcn.00476b40
mov ecx, eax
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x475dd2
mov ecx, dword [ebp - 8]
add ecx, 0x34
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 8]
add ecx, 0x24
call fcn.00476c70
mov esp, ebp
pop ebp
ret
Function at 0x4965d0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a8365
mov eax, dword fs:[0]
push eax
sub esp, 0x1cc
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.004045c0
mov byte [ebp - 4], 1
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x1b0], 0
push 0x70caa8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004886a0
add esp, 0xc
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00404740
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00404770
lea ecx, [ebp - 0x18c]
push ecx
lea ecx, [ebp - 0x1ac]
call fcn.00404810
push eax
call fcn.0066b073
add esp, 8
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffff
je 0x49680b
lea edx, [ebp - 0x18c]
push edx
mov eax, dword [ebp - 0x1b0]
push eax
call fcn.0066b19a
add esp, 8
test eax, eax
jne 0x4967cc
push 0x70caac
lea ecx, [ebp - 0x168]
push ecx
call fcn.0066a2f0
add esp, 8
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
je 0x4967c7
lea ecx, [ebp - 0x1ac]
call fcn.00486290
lea edx, [ebp - 0x168]
push edx
push 0x70cab0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004886a0
add esp, 0xc
mov dword [ebp - 0x1c8], eax
mov edx, dword [ebp - 0x1c8]
mov dword [ebp - 0x1cc], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00488760
add esp, 0xc
mov dword [ebp - 0x1d0], eax
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d4], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00404740
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.00404770
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00404770
cmp dword [ebp - 0x18c], 0x10
jne 0x4967b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1b4], esp
lea edx, [ebp - 0x1ac]
push edx
call fcn.0040d8d0
mov dword [ebp - 0x1d8], eax
call fcn.004965d0
add esp, 0x1c
lea ecx, [ebp - 0x1ac]
call fcn.00404810
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4967c7
lea ecx, [ebp - 0x1ac]
call fcn.00404810
push eax
call fcn.0066a2b2
add esp, 4
jmp 0x49669c
mov eax, dword [ebp - 0x1b0]
push eax
call fcn.0066afce
add esp, 4
mov dword [ebp - 0x1b8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.00404770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404770
mov eax, dword [ebp - 0x1b8]
jmp 0x496839
mov dword [ebp - 0x1bc], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ac]
call fcn.00404770
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404770
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret