joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418ab0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20
push esi
mov esi, eax
call fcn.00418980
test al, al
jne 0x418ac4
pop esi
add esp, 0x20
ret
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov eax, 0x414
push ecx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
mov dword [esp + 0x10], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop esi
add esp, 0x20
ret

Function at 0x418b20
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push esi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x418b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_file__error__d__n
call fcn.0048919b
add esp, 8
xor eax, eax
xor edx, edx
pop esi
add esp, 0x10
ret
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
add esp, 0x10
ret

Function at 0x4192d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4a4858
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00409830
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x419326
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.004191f0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00409830
cmp dword [esp + 0x24], 8
jb 0x41936f
mov edx, dword [esp + 0x10]
push edx
call fcn.00485321
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x419810
Capabilities:
Get socket status

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, eax
push edi
test esi, esi
jg 0x41984e
cmp dword [0x4c72bc], 2
jl 0x419840
push esi
push str.ERROR:_invalid_fd_in_check_fd__d_n
call fcn.0048633a
add eax, 0x40
push eax
call fcn.0048621e
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
test ecx, ecx
jbe 0x419884
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp + 0x10], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [esp + 0x14], ecx
lea edi, [esp + 0x10]
jmp 0x419886
xor edi, edi
mov ebx, dword [sym.imp.WS2_32.dll_select]
lea ebp, [esi + 1]
nop
push edi
push 0
push 0
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
mov esi, eax
test esi, esi
jge 0x4198fe
call fcn.00489b08
mov eax, dword [eax]
cmp eax, 4
jne 0x4198d5
cmp dword [0x4c72bc], 2
jl 0x419890
push str.check_fd
push str._s:_EINTR_n
call fcn.0048633a
add eax, 0x40
push eax
call fcn.0048621e
add esp, 0xc
jmp 0x419890
cmp eax, 0xb
jne 0x41990b
cmp dword [0x4c72bc], 2
jl 0x4198fe
push str.check_fd
push str._s:_EAGAIN_n
call fcn.0048633a
add eax, 0x40
push eax
call fcn.0048621e
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
cmp dword [0x4c72bc], 2
jl 0x419940
call fcn.00489b08
mov ecx, dword [eax]
push ecx
call fcn.00489b79
add esp, 4
push eax
push str.check_fd
push str._s:_select_failed:__s_n
call fcn.0048633a
add eax, 0x40
push eax
call fcn.0048621e
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x114
ret

Function at 0x419950
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
cmp byte [esp + 0x24], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
push ecx
je 0x419985
lea edx, [esp + 0x24]
push edx
push eax
call fcn.004403b2
add esp, 0xc
jmp 0x419994
push eax
lea ebx, [esp + 0x28]
call fcn.0044063b
add esp, 8
xor edi, edi
mov ebx, dword [esp + 0x20]
cmp ebx, edi
jne 0x4199a9
mov eax, 0xfffffbf4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x14]
mov edx, esi
and edx, 0xff0000
mov eax, esi
shr eax, 0x10
or edx, eax
mov ecx, esi
and ecx, 0xff00
mov eax, esi
shl eax, 0x10
or ecx, eax
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
shl ecx, 8
shr edx, 8
or edx, ecx
push 4
lea ecx, [esp + 0x20]
push ecx
push ebp
mov dword [esp + 0x28], edx
call edi
cmp eax, 4
jne 0x4199f4
push 0
push esi
push ebx
push ebp
call edi
push ebx
call fcn.0048556b
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x419a10
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [esp + 0x18]
xor esi, esi
push edi
mov dword [esp + 0x14], esi
cmp eax, esi
jne 0x419a34
mov eax, 0xfffffbf2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [eax], esi
mov eax, ebx
call fcn.00419810
test eax, eax
jg 0x419a4e
mov eax, 0xfffffbf3
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push esi
push 4
lea eax, [esp + 0x1c]
push eax
push ebx
call ebp
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov edx, ecx
shr edx, 0x10
and eax, 0xff0000
or eax, edx
mov edx, ecx
and edx, 0xff00
shl ecx, 0x10
or edx, ecx
shr eax, 8
shl edx, 8
or eax, edx
mov dword [esp + 0x14], eax
je 0x419a41
cmp eax, 0x1000000
jae 0x419a41
push eax
call fcn.004860e8
mov edi, eax
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
jbe 0x419ac0
push 0
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push ebx
call ebp
test eax, eax
jbe 0x419b1a
add esi, eax
mov eax, dword [esp + 0x14]
cmp esi, eax
jb 0x419aa6
mov ecx, str.bplist00
mov esi, edi
mov edx, 8
sub esi, ecx
mov edi, edi
mov ebx, dword [esi + ecx]
cmp ebx, dword [ecx]
jne 0x419b38
sub edx, 4
add ecx, 4
cmp edx, 4
jae 0x419ad0
mov edx, dword [esp + 0x1c]
push edx
push eax
push edi
call fcn.004404df
mov eax, dword [esp + 0x28]
mov esi, dword [eax]
add esp, 0xc
neg esi
sbb esi, esi
and esi, 0x40c
push edi
add esi, 0xfffffbf4
call fcn.0048556b
mov eax, esi
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
cmp esi, eax
jae 0x419ac0
push edi
call fcn.0048556b
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0xfffffbf3
pop ebx
add esp, 8
ret
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
jbe 0x419b57
cmp byte [ecx + edi], 0
jne 0x419b4f
mov byte [ecx + edi], 0x20
mov eax, dword [esp + 0x14]
inc ecx
lea edx, [eax - 1]
cmp ecx, edx
jb 0x419b41
mov ecx, dword [esp + 0x1c]
push ecx
push eax
push edi
call fcn.004405ea
jmp 0x419aee

Function at 0x419b70
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
push str.GetNativeSystemInfo
push str.kernel32.dll
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419bbc
lea ecx, [esp]
push ecx
call eax
jmp 0x419bc6
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp]
cmp ax, 9
je 0x419bdb
cmp ax, 6
je 0x419bdb
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x419bf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov dword [esp + 0x10], 1
mov dword [esp + 8], 0x118
xor edi, edi
call fcn.00419b70
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push 0x20019
push edi
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x419c84
mov edx, dword [esp + 8]
push edx
call fcn.004851c5
mov edi, eax
add esp, 4
test edi, edi
je 0x419c84
mov edx, dword [esp + 0x1c]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x419c84
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419c67
mov esi, dword [esp + 0x20]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
call fcn.00409640
xor esi, esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x419c9c
push edi
call fcn.00486213
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x419cb0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a4b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c3518]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], cx
lea edx, [esp + 8]
push edx
push str.iTunesMobileDeviceDLL
push str.SOFTWAREApple_Inc.Apple_Mobile_Device_SupportShared
mov dword [esp + 0x3c], eax
call fcn.00419bf0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x419d21
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [esp + 0x20], 8
mov ecx, dword [esp + 0xc]
jae 0x419d37
lea ecx, [esp + 0xc]
push esi
call fcn.00401bc0
cmp dword [esp + 0x20], 8
jb 0x419d51
mov eax, dword [esp + 0xc]
push eax
call fcn.00485321
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048532c
add esp, 0x30
ret
Function at 0x419d70
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a4b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c3518]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], cx
lea edx, [esp + 8]
push edx
push str.InstallDir
push str.SOFTWAREApple_Inc.Apple_Application_Support
mov dword [esp + 0x3c], eax
call fcn.00419bf0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x419de1
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [esp + 0x20], 8
mov ecx, dword [esp + 0xc]
jae 0x419df7
lea ecx, [esp + 0xc]
push esi
call fcn.00401bc0
cmp dword [esp + 0x20], 8
jb 0x419e11
mov eax, dword [esp + 0xc]
push eax
call fcn.00485321
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048532c
add esp, 0x30
ret

Function at 0x419e30
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a4b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c3518]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], cx
lea edx, [esp + 8]
push edx
push str.LibraryPath
push str.SOFTWAREApple_Inc.CoreFP
mov dword [esp + 0x3c], eax
call fcn.00419bf0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x419ea1
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [esp + 0x20], 8
mov ecx, dword [esp + 0xc]
jae 0x419eb7
lea ecx, [esp + 0xc]
push esi
call fcn.00401bc0
cmp dword [esp + 0x20], 8
jb 0x419ed1
mov eax, dword [esp + 0xc]
push eax
call fcn.00485321
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048532c
add esp, 0x30
ret
Function at 0x419ef0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a4b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c3518]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], eax
mov word [esp + 0xc], cx
lea edx, [esp + 8]
push edx
push str.path
push str.SOFTWAREApple_Computer__Inc.iPodRegisteredApps4
mov dword [esp + 0x3c], eax
call fcn.00419bf0
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [esp + 0x20], 8
jae 0x419f61
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [esp + 0x20], 8
mov ecx, dword [esp + 0xc]
jae 0x419f77
lea ecx, [esp + 0xc]
push esi
call fcn.00401bc0
cmp dword [esp + 0x20], 8
jb 0x419f91
mov eax, dword [esp + 0xc]
push eax
call fcn.00485321
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048532c
add esp, 0x30
ret
Function at 0x41b890
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push edi
push 0
push 0
push str.PATH
mov esi, eax
call ebp
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x41b8bb
call fcn.00403a20
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [esi]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, edi
or ecx, edx
jge 0x41b8da
mov ecx, edi
mov eax, esi
call fcn.00403b30
mov eax, dword [esi]
push edi
push eax
push str.PATH
call ebp
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x41b8fc
push ecx
push eax
call fcn.00486687
add esp, 8
test eax, eax
jl 0x41b91a
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x41b91a
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
pop edi
pop esi
xor edx, edx
mov ebx, 1
mov word [ecx + eax*2], dx
pop ebp
mov eax, ebx
pop ebx
ret
push 0x80070057
call fcn.00403c30
int3
Function at 0x41f590
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push edi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call ebp
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.004851c5
add esp, 4
push 0
push 0
push edi
mov esi, eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
call ebp
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f5d0
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
mov edx, dword [esp + 0x1c]
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00486213
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4227e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a6d68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x20], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push edx
push eax
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
push eax
push str.Insert_Into__call___address___date___duration___flags___id____t_t_t___Values__s__d__d__d__d__
lea esi, [esp + 0x24]
call fcn.0043a2c0
mov esi, dword [esp + 0x24]
add esp, 0x1c
push esi
mov eax, ebx
call fcn.0043a870
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov edx, dword [edi]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x18]
push ecx
mov ecx, edi
call eax
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x422898
push esi
call fcn.00449dcf
add esp, 4
mov dword [esp + 8], 0
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a5df8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi], vtable.ApplicationImp.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov byte [esi + 0x78], al
mov byte [esi + 0x7a], 1
mov byte [esi + 0x79], 1
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x7c], ecx
mov byte [esi + 0x80], al
cmp ecx, eax
jne 0x42d7d5
push edx
push esi
mov byte [esi + 0x3c], al
call fcn.0042e670
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
cmp ecx, 1
jne 0x42d7e4
mov byte [esi + 0x3c], cl
mov ecx, esi
call fcn.0042e510
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x430390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a45b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4c3518]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
push esi
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ecx, ecx
mov dword [esp + 0xc], ecx
cmp ebx, ecx
je 0x43048c
mov eax, dword [esp + 0x40]
cmp eax, ecx
je 0x43048c
push ecx
push ecx
push eax
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
test ebp, ebp
jg 0x430406
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov word [edi + 4], ax
push eax
jmp 0x43049d
xor ecx, ecx
lea esi, [ebp + 1]
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004851c5
mov esi, eax
add esp, 4
test esi, esi
jne 0x430438
push 0x4aad14
mov esi, edi
call fcn.0040ddaf
jmp 0x4304a9
lea eax, [ebp + 1]
push eax
push 0
push esi
call fcn.0048ab30
mov eax, dword [esp + 0x4c]
add esp, 0xc
push ebp
push esi
push eax
push ebx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push esi
lea eax, [esp + 0x18]
call fcn.0040dd8b
push esi
mov dword [esp + 0x3c], 0
call fcn.00486213
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov esi, edi
call fcn.0040ddce
lea esi, [esp + 0x10]
call fcn.004090c0
jmp 0x4304a9
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ecx
mov word [edi + 4], dx
push ecx
mov eax, 0x4aad14
mov esi, edi
call fcn.00409640
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048532c
add esp, 0x30
ret
Function at 0x4306d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a57f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c3518]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, 1
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x5c], 0
lea ebp, [ebx + 7]
jbe 0x43088f
cmp dword [esp + 0x78], 0
jbe 0x43088f
mov esi, dword [esp + 0x4c]
cmp dword [esp + 0x60], ebp
jae 0x430727
lea esi, [esp + 0x4c]
call fcn.00418980
test al, al
je 0x43088f
mov esi, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x430742
lea esi, [esp + 0x68]
call fcn.00438ec0
test al, al
je 0x430760
mov eax, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x430759
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 0x1c
mov esi, esp
xor eax, eax
mov edi, 7
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 0
mov dword [esp + 0x30], esp
mov word [esi + 4], ax
push ebx
mov eax, 0x4b2e6c
call fcn.00409640
sub esp, 0x1c
mov byte [esp + 0x78], 2
mov ecx, esp
mov dword [esp + 0x50], esp
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], 0
push edx
lea eax, [esp + 0x88]
mov word [ecx + 4], dx
call fcn.00409830
lea ecx, [esp + 0x54]
mov byte [esp + 0x78], bl
call fcn.0042ff10
add esp, 0x38
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x50]
mov byte [esp + 0x48], 3
call fcn.00409830
mov byte [esp + 0x40], bl
cmp dword [esp + 0x34], ebp
jb 0x4307ef
mov eax, dword [esp + 0x20]
push eax
call fcn.00485321
add esp, 4
mov eax, dword [esp + 0x68]
cmp dword [esp + 0x7c], ebp
jae 0x4307fd
lea eax, [esp + 0x68]
push eax
call fcn.0047f4c5
mov edi, eax
add esp, 4
test edi, edi
jne 0x430823
lea esi, [esp + 0x48]
call fcn.004090c0
lea esi, [esp + 0x64]
call fcn.004090c0
jmp 0x4308cc
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 0x4aad14
call fcn.0040ddaf
sub esp, 0x1c
mov byte [esp + 0x78], 4
lea ecx, [esp + 0x80]
mov esi, esp
mov dword [esp + 0x4c], esp
push ecx
call fcn.0040ddce
push edi
mov byte [esp + 0x7c], bl
call fcn.004308f0
mov bl, al
add esp, 0x3c
mov eax, edi
call fcn.0047fb31
lea esi, [esp + 0x48]
call fcn.004090c0
lea esi, [esp + 0x64]
call fcn.004090c0
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
cmp dword [esp + 0x60], ebp
jb 0x4308a2
mov edx, dword [esp + 0x4c]
push edx
call fcn.00485321
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
cmp dword [esp + 0x7c], ebp
jb 0x4308cc
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00485321
add esp, 4
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret