joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4120d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7297
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x57aa54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 4], 1
push 0x44
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.0049ce00
add esp, 0xc
mov dword [ebp - 0x64], 0x44
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x41212b
mov dword [ebp - 0x38], 1
xor edx, edx
mov word [ebp - 0x34], dx
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0049ce00
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebp + 0xc]
call fcn.0040a3e0
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.0040a3e0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41221c
movzx eax, byte [ebp + 0x14]
test eax, eax
jne 0x41219e
mov byte [ebp - 0x69], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403970
mov al, byte [ebp - 0x69]
jmp 0x412281
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x4121e0
mov byte [ebp - 0x6a], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403970
mov al, byte [ebp - 0x6a]
jmp 0x412281
mov eax, dword [ebp + 8]
push eax
push 0x4bfd18
mov ecx, dword [ebp - 0x78]
add ecx, 0x20
push ecx
call fcn.004044a0
add esp, 0xc
mov byte [ebp - 0x6b], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403970
mov al, byte [ebp - 0x6b]
jmp 0x412281
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
call fcn.0040a190
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x80]
mov eax, dword [edx]
push eax
push str.Failed_to_run_the_application___d_:__s
mov ecx, dword [ebp - 0x78]
add ecx, 0x20
push ecx
call fcn.004044a0
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00403970
mov byte [ebp - 0x71], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00403970
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4150f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x57aa54]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x124]
call fcn.004151a0
push 0x400
mov ecx, dword [ebp - 0x124]
add ecx, 0x38
call fcn.004039d0
push eax
call fcn.00414760
add esp, 4
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x124]
add ecx, 0x38
call fcn.0040ac70
mov eax, dword [ebp - 0x124]
mov byte [eax + 0x3c], 0
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41517c
cmp dword [ebp - 0x11c], 5
sbb edx, edx
add edx, 1
mov eax, dword [ebp - 0x124]
mov byte [eax + 0x3c], dl
jmp 0x415186
mov ecx, dword [ebp - 0x124]
mov byte [ecx + 0x3c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049c63c
mov esp, ebp
pop ebp
ret
Function at 0x415670
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b76f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x57aa54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x24], 4
push str.AlbumMaker.ini
lea ecx, [ebp - 0x18]
call fcn.004038f0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004157c0
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00403970
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4156ef
xor al, al
jmp 0x4157ad
push str.FtpConfig.ini
lea ecx, [ebp - 0x20]
call fcn.004038f0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004157c0
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x19], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00403970
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x415739
xor al, al
jmp 0x4157ad
push str.MPR500_Pro_5User.ini
lea ecx, [ebp - 0x24]
call fcn.004038f0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 8
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004032e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00403970
lea ecx, [ebp - 0x10]
call fcn.0040ca60
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ca60
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov byte [ebp - 0x25], 1
lea ecx, [ebp - 0x10]
call fcn.00403970
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4160b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7844
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x57aa54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040ca60
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x41612d
push 0x4c176c
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov ecx, dword [ebp - 0x38]
or ecx, 1
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
jmp 0x416299
mov edx, dword [ebp - 0x20]
push edx
call fcn.0049d8e4
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x416160
push 0x4c1770
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov eax, dword [ebp - 0x38]
or eax, 1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
jmp 0x416299
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040ca60
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4161a8
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0049d9ae
add esp, 4
push 0x4c1774
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov edx, dword [ebp - 0x38]
or edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp + 8]
jmp 0x416299
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0x4c1778
mov edx, dword [ebp - 0x18]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x416274
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x28], cx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x24], ax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x2c], dx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x34], cx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0049d9ae
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.004038b0
mov dword [ebp - 4], 0
movzx eax, word [ebp - 0x34]
push eax
movzx ecx, word [ebp - 0x2c]
push ecx
movzx edx, word [ebp - 0x24]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x4c177c
lea ecx, [ebp - 0x30]
push ecx
call fcn.004044a0
add esp, 0x18
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp + 8]
call fcn.004038d0
mov eax, dword [ebp - 0x38]
or eax, 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00403970
mov eax, dword [ebp + 8]
jmp 0x416299
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0049d9ae
add esp, 4
push 0x4c1794
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov edx, dword [ebp - 0x38]
or edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4166f0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b78bb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x57aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x228]
call fcn.004038f0
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
call fcn.00403390
mov byte [ebp - 0x221], al
lea ecx, [ebp - 0x228]
call fcn.00403970
movzx edx, byte [ebp - 0x221]
test edx, edx
je 0x4167b3
push str.Get_temporary_folder_failed
mov ecx, dword [ebp - 0x234]
add ecx, 0x20
call fcn.004039b0
push 0x4c18cc
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov eax, dword [ebp - 0x230]
or eax, 1
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 8]
jmp 0x4168ff
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x220]
call fcn.004038f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.004039f0
cmp eax, 1
jle 0x416865
lea ecx, [ebp - 0x220]
call fcn.004039f0
sub eax, 1
push eax
lea ecx, [ebp - 0x220]
call fcn.0040c9e0
movzx eax, ax
cmp eax, 0x5c
jne 0x416865
lea ecx, [ebp - 0x220]
call fcn.004039f0
sub eax, 1
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00403260
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x240], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x220]
call fcn.00403990
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00403970
lea ecx, [ebp - 0x220]
push ecx
call fcn.0040e380
add esp, 4
movzx edx, al
test edx, edx
jne 0x4168cc
mov eax, dword [ebp - 0x220]
push eax
push str.Temporary_folder_cannot_be_created:__s
mov ecx, dword [ebp - 0x234]
add ecx, 0x20
push ecx
call fcn.004044a0
add esp, 0xc
push 0x4c19a8
mov ecx, dword [ebp + 8]
call fcn.004038f0
mov edx, dword [ebp - 0x230]
or edx, 1
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00403970
mov eax, dword [ebp + 8]
jmp 0x4168ff
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
call fcn.004038d0
mov ecx, dword [ebp - 0x230]
or ecx, 1
mov dword [ebp - 0x230], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00403970
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049c63c
mov esp, ebp
pop ebp
ret 4
Function at 0x430a47
Capabilities:
Get file size

Disassembly:
mov eax, 0x4b9bcc
call fcn.0049e324
sub esp, 0x90
mov eax, dword [ebp + 0x10]
and byte [eax], 0
cmp dword [ebp + 8], 0
jne 0x430a6a
xor eax, eax
jmp 0x430bac
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
jne 0x430a7b
xor eax, eax
jmp 0x430bac
lea ecx, [ebp - 0x74]
call fcn.00418897
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x74]
call fcn.00418bb6
push 0x5c
push 0x2f
lea ecx, [ebp - 0x74]
call fcn.00419860
push dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
call fcn.004306c3
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x430ad3
and dword [ebp - 0x94], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x94]
jmp 0x430bac
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x430b7f
cmp dword [ebp + 0xc], 0
je 0x430b54
lea ecx, [ebp - 0x90]
call fcn.0041aa17
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.0041bbf3
lea ecx, [ebp - 0x90]
call fcn.00419db6
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
push dword [ebp + 8]
push str.filename
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x28]
push str.Failed_to_get_file_size
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.0041aba9
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 0x98], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x98]
jmp 0x430bac
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x430bb8
Capabilities:
Get file size

Disassembly:
mov eax, 0x4b9bcc
call fcn.0049e324
sub esp, 0x90
mov eax, dword [ebp + 0x10]
and byte [eax], 0
cmp dword [ebp + 8], 0
jne 0x430bdb
xor eax, eax
jmp 0x430d21
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test eax, eax
jne 0x430bec
xor eax, eax
jmp 0x430d21
lea ecx, [ebp - 0x74]
call fcn.00418897
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x74]
call fcn.00418c99
push 0x5c
push 0x2f
lea ecx, [ebp - 0x74]
call fcn.00419860
push dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
call fcn.004306c3
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x430c44
and dword [ebp - 0x94], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x94]
jmp 0x430d21
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x430cf0
cmp dword [ebp + 0xc], 0
je 0x430cc5
lea ecx, [ebp - 0x90]
call fcn.0041aa17
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x90]
call fcn.0041bbf3
lea ecx, [ebp - 0x90]
call fcn.00419db6
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
push dword [ebp + 8]
push str.filename
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x28]
push str.Failed_to_get_file_size
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.0041aba9
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 0x98], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x98]
jmp 0x430d21
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
or dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x9c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4310ab
Capabilities:
Delete file

Disassembly:
mov eax, 0x4b90a3
call fcn.0049e324
sub esp, 0x44
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
call fcn.0041a951
and dword [ebp - 4], 0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x2c]
call fcn.00419f28
lea ecx, [ebp - 0x2c]
call fcn.00419db6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4310ee
mov eax, dword [ebp - 0x30]
movsx eax, byte [eax]
test eax, eax
jne 0x43111c
cmp dword [ebp + 0xc], 0
je 0x431104
push str.Cannot_delete_file__filename_is_null_or_empty
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x10]
and byte [ebp - 0x4d], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041aba9
mov al, byte [ebp - 0x4d]
jmp 0x431215
push dword [ebp + 0xc]
push dword [ebp - 0x30]
call fcn.00430e46
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x431171
cmp dword [ebp + 0xc], 0
je 0x431159
push dword [ebp - 0x30]
push str.delete_filename
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x28]
push str.Cannot_delete_file__file_does_not_exist
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x14]
and byte [ebp - 0x4e], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041aba9
mov al, byte [ebp - 0x4e]
jmp 0x431215
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x431202
cmp dword [ebp + 0xc], 0
je 0x4311ed
lea ecx, [ebp - 0x4c]
call fcn.0041aa17
mov byte [ebp - 4], 1
push str.DeleteFile:
lea ecx, [ebp - 0x4c]
call fcn.0041a5d6
lea ecx, [ebp - 0x4c]
call fcn.0041bbf3
push str.Cannot_delete_file
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x14]
push dword [ebp - 0x30]
push str.delete_filename
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x28]
lea ecx, [ebp - 0x4c]
call fcn.00419db6
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
call dword [eax + 0x14]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.0041aba9
and byte [ebp - 0x4f], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041aba9
mov al, byte [ebp - 0x4f]
jmp 0x431215
mov byte [ebp - 0x50], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041aba9
mov al, byte [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x431695
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4b9112
call fcn.0049e324
sub esp, 0x8c
cmp dword [ebp + 8], 0
jne 0x4316b2
xor al, al
jmp 0x431829
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
jne 0x4316c3
xor al, al
jmp 0x431829
lea ecx, [ebp - 0x74]
call fcn.00418897
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x74]
call fcn.00418bb6
push dword [ebp + 0x14]
lea eax, [ebp - 0x74]
push eax
push 0x33
call fcn.0043056e
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43173b
cmp dword [ebp + 0x14], 0
je 0x43171d
push dword [ebp + 8]
push str.filename
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x28]
push str.Failed_to_write_complete_file__7_
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
and byte [ebp - 0x95], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0x95]
jmp 0x431829
cmp dword [ebp + 0xc], 0
je 0x431804
cmp dword [ebp + 0x10], 0
je 0x431804
and dword [ebp - 0x78], 0
push 0
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x10]
je 0x431804
cmp dword [ebp + 0x14], 0
je 0x4317dd
lea ecx, [ebp - 0x94]
call fcn.0041aa17
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94]
call fcn.0041bbf3
push dword [ebp + 8]
push str.filename
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x28]
lea ecx, [ebp - 0x94]
call fcn.00419db6
push eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
push str.Failed_to_write_complete_file__1_
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.0041aba9
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
and byte [ebp - 0x96], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0x96]
jmp 0x431829
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
mov byte [ebp - 0x97], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0x97]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x431835
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4b913a
call fcn.0049e324
sub esp, 0xec
cmp dword [ebp + 8], 0
jne 0x431852
xor al, al
jmp 0x4319df
lea ecx, [ebp - 0x74]
call fcn.00418897
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x74]
call fcn.00418c99
push dword [ebp + 0x14]
lea eax, [ebp - 0x74]
push eax
push 0x34
call fcn.0043056e
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4318ff
cmp dword [ebp + 0x14], 0
je 0x4318e1
lea ecx, [ebp - 0xd4]
call fcn.00418897
mov byte [ebp - 4], 1
push dword [ebp + 8]
lea ecx, [ebp - 0xd4]
call fcn.00418c99
lea ecx, [ebp - 0xd4]
call fcn.00419532
push eax
push str.utf8Filename
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x28]
push str.Failed_to_write_complete_file__6_
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
and byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.0041896f
and byte [ebp - 0xf5], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0xf5]
jmp 0x4319df
cmp dword [ebp + 0xc], 0
je 0x4319ba
cmp dword [ebp + 0x10], 0
je 0x4319ba
and dword [ebp - 0xd8], 0
push 0
lea eax, [ebp - 0xd8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp + 0x10]
je 0x4319ba
cmp dword [ebp + 0x14], 0
je 0x431993
lea ecx, [ebp - 0xf4]
call fcn.0041aa17
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf4]
call fcn.0041bbf3
lea ecx, [ebp - 0xf4]
call fcn.00419db6
push eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
push str.Failed_to_write_complete_file__3_
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
call dword [eax + 0x10]
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.0041aba9
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
and byte [ebp - 0xf6], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0xf6]
jmp 0x4319df
push 0
push dword [ebp - 0x10]
call fcn.00436fc2
pop ecx
pop ecx
mov byte [ebp - 0xf7], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041896f
mov al, byte [ebp - 0xf7]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret