joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40592c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405992
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404088
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b8c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40597c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405999
lea eax, [ebp - 0x10]
call fcn.00403e18
ret

Function at 0x4075dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004042d8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4075f5
test al, 0x10
jne 0x4075f9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4076e8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004042d8
push eax
call sub.kernel32.dll_GetFileAttributesA
pop ebx
ret

Function at 0x4076fc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.004042d8
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x40771e
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a1c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a1f9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f08
jmp 0x40a202
mov eax, ebx
mov edx, esi
call fcn.00403e6c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a20c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a22d
mov al, byte [esp]
jmp 0x40a22f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40a8b4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a72c
mov eax, dword [0x41b5d8]
cmp byte [eax], 0
je 0x40a930
mov eax, dword [0x41b49c]
call fcn.00402a98
call fcn.004027b8
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407a7c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a978
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a966
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41b474]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41c660]
call fcn.00404e7c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40b6c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b724
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404088
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407250
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b72b
lea eax, [ebp - 0xc]
call fcn.00403e18
ret

Function at 0x418698
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4186d6
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
jmp 0x418727
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x41870a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x41870a
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 0xc]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x418f38
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x418f41
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41907d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
inc dword [ebx + 0x18]
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00418e40
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x22]
call fcn.00407ad8
lea ecx, [ebp - 0xc]
mov edx, dword [ebx + 0x14]
mov eax, esi
call fcn.00418cb4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x122]
call fcn.00407ad8
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x18]
mov eax, esi
call fcn.00418d8c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x222]
call fcn.00407ad8
cmp word [esi + 0x72], 0
je 0x418fce
push edi
lea eax, [ebp - 1]
push eax
mov ecx, ebx
mov edx, esi
mov eax, dword [esi + 0x74]
call dword [esi + 0x70]
cmp byte [ebp - 1], 0
jne 0x41903f
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00404088
mov eax, dword [ebp - 0x14]
call fcn.00407600
lea eax, [ebp - 0x24]
lea edx, [ebx + 0x222]
mov ecx, pe_nt_image_headers32
call fcn.00404088
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x122]
mov ecx, pe_nt_image_headers32
call fcn.00404088
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov edx, 1
call fcn.00418428
mov eax, dword [ebp - 0x18]
call fcn.004042d8
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
mov dword [esi + 0x3d4], eax
xor eax, eax
mov dword [esi + 0x3d8], eax
mov bl, byte [ebp - 1]
xor bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419084
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403e3c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00403e3c
ret
Function at 0x41a664
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
xor ecx, ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042c8
mov eax, dword [ebp - 8]
call fcn.004042c8
xor eax, eax
push ebp
push 0x41a74d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x50], 0x44
xor eax, eax
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x1e], 0
xor eax, eax
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 4]
call fcn.00407930
push dword [ebp - 0x64]
push 0x41a760
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404198
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.004078fc
mov eax, dword [ebp - 0x68]
call fcn.004042d8
push eax
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004042d8
push eax
mov eax, dword [ebp - 4]
call fcn.004042d8
push eax
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a754
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00403e3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e3c
ret
Function at 0x41a764
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x41a76c
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042c8
xor eax, eax
push ebp
push 0x41a94f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x148]
mov ecx, 0x41a964
mov edx, dword [ebp - 4]
call fcn.00404124
mov eax, dword [ebp - 0x148]
call fcn.004042d8
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
mov eax, ebx
cdq
cmp edx, 0
jne 0x41a7c5
cmp eax, 0xffffffff
je 0x41a91c
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404088
mov edx, dword [ebp - 0x14c]
mov eax, 0x41a974
call fcn.0040441c
dec eax
je 0x41a907
mov eax, dword [ebp - 0x144]
and eax, 0x10
cmp eax, 0x10
jne 0x41a8b1
push dword [ebp - 4]
push 0x41a980
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404088
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00407930
push dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00404198
mov eax, dword [ebp - 0x150]
call fcn.0041a764
push dword [ebp - 4]
push 0x41a980
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404088
mov eax, dword [ebp - 0x164]
lea edx, [ebp - 0x160]
call fcn.00407930
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404198
mov eax, dword [ebp - 0x15c]
call fcn.004029e4
call fcn.004027b8
jmp 0x41a907
push dword [ebp - 4]
push 0x41a980
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404088
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x16c]
call fcn.00407930
push dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00404198
mov eax, dword [ebp - 0x168]
call fcn.004042d8
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x41a7cb
push ebx
call sub.kernel32.dll_FindClose_1
push 0
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a956
lea eax, [ebp - 0x170]
mov edx, 0xb
call fcn.00403e3c
lea eax, [ebp - 4]
call fcn.00403e18
ret
Function at 0x41aa4c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x41aa54
push ebx
push esi
push edi
mov eax, 0x41a9ac
call fcn.00405b8c
xor eax, eax
push ebp
push 0x41ad95
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x41c88c
xor eax, eax
call fcn.00402984
push 0x104
push 0x41c894
mov eax, dword [0x41c88c]
call fcn.004042d8
push eax
call sub.kernel32.dll_GetShortPathNameA
push 0x41c998
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, 0x41dac4
mov edx, 0x41c998
mov ecx, 0x104
call fcn.00404088
cmp dword [0x41dac4], 0
je 0x41aaee
mov eax, dword [0x41dac4]
call fcn.004040d8
mov edx, dword [0x41dac4]
cmp byte [edx + eax - 1], 0x5c
je 0x41aaee
mov eax, 0x41dac4
mov edx, 0x41adac
call fcn.004040e0
lea eax, [ebp - 0x14]
mov edx, 0x41c894
mov ecx, 0x104
call fcn.00404088
mov eax, dword [ebp - 0x14]
mov edx, 0x40
call fcn.0040743c
mov dword [0x41c890], eax
cmp dword [0x41c890], 0xffffffff
je 0x41ad7a
mov ecx, 2
mov edx, 0xffffffd8
mov eax, dword [0x41c890]
call fcn.00407518
mov eax, 0x41ca9c
mov ecx, 0x28
mov edx, 0x28
call fcn.00402b6c
mov edx, 0x41ca9c
mov ecx, 0x28
mov eax, dword [0x41c890]
call fcn.004074c0
cmp dword [0x41cac0], 0
jle 0x41ad70
lea eax, [ebp - 0x18]
mov ecx, 0x41adb8
mov edx, dword [0x41dac4]
call fcn.00404124
mov eax, dword [ebp - 0x18]
call fcn.00407494
mov edi, eax
xor ecx, ecx
mov edx, dword [0x41cabc]
mov eax, dword [0x41c890]
call fcn.00407518
xor esi, esi
mov dword [0x41dac0], 0xffc
mov ebx, dword [0x41dac0]
lea edx, [ebx + esi]
mov eax, dword [0x41cac0]
cmp edx, eax
jle 0x41abb9
mov ebx, eax
sub ebx, esi
mov edx, 0x41cac4
mov ecx, ebx
mov eax, dword [0x41c890]
call fcn.004074c0
mov edx, 0x41cac4
mov ecx, ebx
mov eax, edi
call fcn.004074ec
add esi, ebx
cmp esi, dword [0x41cac0]
jne 0x41aba3
mov eax, edi
call fcn.0040755c
mov dl, 1
mov eax, dword [0x419db4]
call fcn.00419e48
mov dword [0x41dacc], eax
call fcn.00408c5c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0x1c]
mov eax, 0x41adcc
call fcn.004098a8
mov edx, dword [ebp - 0x1c]
mov eax, 0x41dac8
call fcn.00403e6c
xor eax, eax
push ebp
push 0x41acaa
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x41dac4]
push dword [0x41dac8]
push 0x41adac
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404198
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
mov ecx, 0x41adb8
mov edx, dword [0x41dac4]
call fcn.00404124
mov edx, dword [ebp - 0x24]
mov eax, dword [0x41dacc]
pop ecx
call fcn.0041a460
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41acb1
mov eax, dword [0x41dacc]
call fcn.00403120
lea eax, [ebp - 0x28]
mov ecx, 0x41adb8
mov edx, dword [0x41dac4]
call fcn.00404124
mov eax, dword [ebp - 0x28]
call fcn.004042d8
push eax
call sub.kernel32.dll_DeleteFileA
ret
mov eax, dword [0x41c890]
call fcn.0040755c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ad9c
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.00403e3c
ret
Function at 0x10024e1
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001298
call fcn.01002680
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100251c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100251c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002534
cmp eax, 0x20b
je 0x1002521
mov dword [ebp - 0x1c], edi
jmp 0x1002548
cmp dword [ecx + 0x84], 0xe
jbe 0x100251c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002542
cmp dword [ecx + 0x74], 0xe
jbe 0x100251c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100db0c], 0xffffffff
or dword [0x100db10], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10032fc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10032f8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100db14], eax
call fcn.0100267a
cmp dword [0x1003008], edi
jne 0x10025a3
push fcn.0100267a
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002668
push 0x10010f4
push 0x10010f0
call sub.msvcrt.dll__initterm
mov eax, dword [0x10032f4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10032f0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010ec
push 0x10010e8
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002176
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x100261a
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100264f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010026b9
ret
Function at 0x421480
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce607
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.00418140
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418140
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.0041a2d0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0041ac00
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0041ac00
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.0044dc00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0044dc80
movzx edx, al
test edx, edx
je 0x42155e
lea ecx, [ebp - 0x1bc]
call fcn.00419550
push eax
lea ecx, [ebp - 0x134]
call fcn.00419550
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x42163c
lea ecx, [ebp - 0x134]
call fcn.004182d0
test eax, eax
jg 0x421580
lea ecx, [ebp - 0x1bc]
call fcn.004182d0
test eax, eax
jle 0x421613
lea ecx, [ebp - 0x24c]
call fcn.00418140
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418140
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.004216b0
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.004216b0
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.00418be0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00418250
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418250
jmp 0x42163c
lea ecx, [ebp - 0x1bc]
call fcn.00418be0
push eax
lea ecx, [ebp - 0x134]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x421655
cmp dword [ebp + 0x10], 0
je 0x421655
mov ecx, dword [ebp + 0x10]
call fcn.00435750
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0044dc60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00418250
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.00418250
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005af2c3
mov esp, ebp
pop ebp
ret
Function at 0x4217e0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce68c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ac00
lea ecx, [ebp - 0x134]
call fcn.0044dc00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.0044dc80
movzx ecx, al
test ecx, ecx
je 0x4218a8
lea ecx, [ebp - 0x94]
call fcn.00419550
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x255]
jmp 0x421a7b
lea ecx, [ebp - 0x94]
call fcn.004182d0
cmp eax, 0x104
jle 0x4219ae
lea ecx, [ebp - 0x1bc]
call fcn.00418140
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.00421110
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00418140
mov byte [ebp - 4], 3
push 0x61b5bc
lea ecx, [ebp - 0x24c]
call fcn.00419d90
lea ecx, [ebp - 0x1bc]
call fcn.00419fb0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00419d90
lea ecx, [ebp - 0x24c]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x42194f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42194f
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00418250
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00418250
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x256]
jmp 0x421a7b
lea ecx, [ebp - 0x94]
call fcn.00418be0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x421a21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x421a0e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004357f0
lea ecx, [ebp - 0x94]
call fcn.00419fb0
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x421a21
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x257]
jmp 0x421a7b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005af2c3
mov esp, ebp
pop ebp
ret
Function at 0x422a50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce791
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6a1da0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.004182d0
test eax, eax
jne 0x422abb
cmp dword [ebp + 0x14], 0
je 0x422ab4
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x422c24
lea ecx, [ebp - 0x94]
call fcn.00418140
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041a2d0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0041ac00
lea ecx, [ebp - 0x94]
call fcn.004182d0
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.0044dc00
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x422b6c
lea ecx, [ebp - 0x94]
call fcn.00419230
movzx ecx, al
test ecx, ecx
jne 0x422b3b
lea ecx, [ebp - 0x134]
call fcn.0044dc80
movzx edx, al
test edx, edx
je 0x422b6c
lea ecx, [ebp - 0x94]
call fcn.00419550
push eax
call fcn.004248c0
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x422b67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x422bec
cmp dword [ebp - 0x138], 0
jle 0x422bc2
lea ecx, [ebp - 0x1c4]
call fcn.00418140
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.004216b0
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00418c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00418250
jmp 0x422bd9
lea ecx, [ebp - 0x94]
call fcn.00418c00
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x422bec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0044dc60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00418250
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005af2c3
mov esp, ebp
pop ebp
ret