joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e2d0
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x619948
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6fadcc]
xor eax, esp
push eax
lea eax, [esp + 0x1d0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1e0]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1d8], ebx
xor eax, eax
cmp dword [esp + 0x1fc], 0x10
mov ecx, 0x2a
lea esi, [esp + 0x18]
lea edi, [esp + 0xc0]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x1e8]
mov dword [esp + 0x148], 0x6a09e667
mov dword [esp + 0x14c], 0xbb67ae85
mov dword [esp + 0x150], 0x3c6ef372
mov dword [esp + 0x154], 0xa54ff53a
mov dword [esp + 0x158], 0x510e527f
mov dword [esp + 0x15c], 0x9b05688c
mov dword [esp + 0x160], 0x1f83d9ab
mov dword [esp + 0x164], 0x5be0cd19
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc0], ebx
jae 0x41e3e9
lea eax, [esp + 0x1e8]
push eax
mov eax, dword [esp + 0x1fc]
lea esi, [esp + 0xc4]
call fcn.0041e080
lea edi, [esp + 0x168]
call fcn.0041e110
mov byte [esp + 0x1c8], bl
xor esi, esi
lea edi, [esp + 0x188]
lea esp, [esp]
movzx eax, byte [esp + esi + 0x168]
push eax
push str._02x
push edi
call fcn.005e15b9
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x20
jb 0x41e420
lea eax, [esp + 0x188]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], ebx
mov byte [ebp + 4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41e457
sub eax, edx
push eax
lea ecx, [esp + 0x18c]
push ecx
mov ecx, ebp
call fcn.00407140
cmp dword [esp + 0x1fc], 0x10
jb 0x41e48a
mov edx, dword [esp + 0x1e8]
push edx
call fcn.005bd360
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x1d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.005e0eb7
add esp, 0x1c8
ret

Function at 0x41edf0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x74
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
push ebx
push esi
mov dword [esp + 8], ecx
mov byte [esp + 0xc], cl
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
push eax
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0x10]
mov dword [esp + 0x5c], 0x67452301
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x98badcfe
mov dword [esp + 0x68], 0x10325476
call fcn.0041ebb0
lea esi, [esp + 0xc]
call fcn.0041ec50
push edi
mov ebx, esi
call fcn.0041ed40
mov ecx, dword [esp + 0x78]
pop esi
pop ebx
xor ecx, esp
mov eax, edi
call fcn.005e0eb7
add esp, 0x74
ret
Function at 0x429970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
lea edi, [eax + esi]
cmp eax, 8
ja 0x4299b6
mov eax, 0xffffffe2
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.005e0eb7
mov esp, ebp
pop ebp
ret
add esi, 8
lea eax, [ebx + 0x681c]
push eax
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [ebx + 0x2818]
push esi
push edx
call fcn.00450970
add esp, 0x10
cmp eax, 0xffffff88
ja 0x42999d
add esi, eax
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x24], 0x1f
call fcn.0044dcc0
add esp, 0x14
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x42999d
mov ecx, dword [esp + 0x10]
cmp ecx, 0x1f
ja 0x42999d
mov eax, dword [esp + 0x24]
cmp eax, 8
ja 0x42999d
push eax
push 0x6c3758
push 0x6c36d8
push ecx
lea ecx, [esp + 0x38]
push ecx
lea edx, [ebx + 0x1008]
push edx
call fcn.00427200
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0x38], 0x34
call fcn.0044dcc0
add esp, 0x2c
mov dword [esp + 8], eax
cmp eax, 0xffffff88
ja 0x42999d
mov ecx, dword [esp + 0xc]
cmp ecx, 0x34
ja 0x42999d
mov eax, dword [esp + 0x1c]
cmp eax, 9
ja 0x42999d
push eax
push 0x6c2fb0
push 0x6c37d8
push ecx
lea ecx, [esp + 0xc0]
push ecx
lea edx, [ebx + 0x1810]
push edx
call fcn.00427200
add esi, dword [esp + 0x20]
mov eax, edi
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x34], 0x23
call fcn.0044dcc0
add esp, 0x2c
mov dword [esp + 0x20], eax
cmp eax, 0xffffff88
ja 0x42999d
mov ecx, dword [esp + 8]
cmp ecx, 0x23
ja 0x42999d
mov eax, dword [esp + 0x14]
cmp eax, 9
ja 0x42999d
push eax
push 0x6c2ed8
push 0x6c3648
push ecx
lea ecx, [esp + 0x78]
push ecx
push ebx
call fcn.00427200
add esi, dword [esp + 0x38]
add esp, 0x18
lea edx, [esi + 0xc]
cmp edx, edi
ja 0x42999d
sub edi, esi
sub edi, 0xc
xor ecx, ecx
lea edx, [ebx + 0x701c]
mov eax, dword [esi]
add esi, 4
test eax, eax
je 0x42999d
cmp eax, edi
jae 0x42999d
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 3
jl 0x429b35
mov ecx, dword [esp + 0x124]
mov eax, esi
sub eax, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.005e0eb7
mov esp, ebp
pop ebp
ret
Function at 0x452b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7fc
mov eax, dword [0x6fadcc]
xor eax, esp
mov dword [esp + 0x7f4], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x40
lea eax, [esp + 0x80]
push esi
push eax
mov edi, ecx
mov dword [esp + 0x84], esi
call fcn.005e4a10
add esp, 0xc
push 0x44
lea ecx, [esp + 0x38]
push esi
push ecx
mov dword [esp + 0x3c], esi
call fcn.005e4a10
mov ebx, dword [edi]
add edi, 4
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp ebx, 0x10
jbe 0x452b96
mov eax, 0xffffffd4
jmp 0x452d1e
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x50c]
push edx
call fcn.004520f0
add esp, 0x10
mov dword [esp + 0x2c], eax
cmp eax, 0xffffff88
ja 0x452d1e
mov edi, dword [esp + 0x1c]
cmp edi, ebx
ja 0x452b8c
mov dword [esp + 0x14], edi
cmp dword [esp + edi*4 + 0x78], esi
jne 0x452bf0
dec edi
cmp dword [esp + edi*4 + 0x78], esi
je 0x452be5
mov dword [esp + 0x14], edi
xor ebp, ebp
lea eax, [ebp + 1]
lea ebx, [edi + 1]
mov dword [esp + 0x20], ebp
cmp ebx, eax
jbe 0x452c13
mov ecx, ebp
add ebp, dword [esp + eax*4 + 0x78]
mov dword [esp + eax*4 + 0x34], ecx
inc eax
cmp eax, ebx
jb 0x452c00
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], ebp
test esi, esi
jbe 0x452c4b
movzx edx, byte [esp + eax + 0x500]
mov ecx, dword [esp + edx*4 + 0x34]
mov byte [esp + ecx*2 + 0x600], al
inc eax
lea edi, [ecx + 1]
mov dword [esp + edx*4 + 0x34], edi
mov byte [esp + ecx*2 + 0x601], dl
cmp eax, esi
jb 0x452c21
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x1c]
xor esi, esi
lea eax, [esi + 1]
dec edx
mov dword [esp + 0x34], esi
cmp ebx, eax
jbe 0x452c82
mov ebp, dword [esp + eax*4 + 0x78]
lea ecx, [eax + edx]
shl ebp, cl
mov edi, esi
mov dword [esp + eax*4 + 0xc0], edi
inc eax
add esi, ebp
cmp eax, ebx
jb 0x452c61
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov edi, dword [esp + 0x24]
inc ecx
sub edi, ecx
inc edi
cmp ecx, edi
jae 0x452ce7
mov edx, ecx
neg edx
mov eax, ecx
shl eax, 4
shl edx, 4
add eax, ecx
sub edx, ecx
lea eax, [esp + eax*4 + 0xc4]
add edx, edx
mov dword [esp + 0x18], eax
add edx, edx
cmp ebx, 1
jbe 0x452cd4
lea esi, [ebx - 1]
jmp 0x452cc0
mov ebp, dword [edx + eax]
shr ebp, cl
add eax, 4
sub esi, 1
mov dword [eax - 4], ebp
jne 0x452cc0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ecx
add eax, 0x44
sub edx, 0x44
mov dword [esp + 0x18], eax
cmp ecx, edi
jb 0x452cb3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
inc ecx
push ecx
push edx
lea eax, [esp + 0xc8]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call fcn.00452a00
mov eax, dword [esp + 0x4c]
add esp, 0x20
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0eb7
add esp, 0x7fc
ret
Function at 0x45abe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x80]
mov ebx, dword [edi + 0x6860]
lea ecx, [esi + eax]
mov dword [esp + 0x28], ecx
lea ecx, [edx + ebp]
lea edx, [edi + 0x1004]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0x6814]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x6818]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x681c]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x6858]
push edx
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [edi + 0x685c]
mov dword [esp + 0x20], ecx
add ebx, ecx
push esi
lea ecx, [edi + 0x1808]
push eax
push ecx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x98]
call fcn.0045a440
add esp, 0x18
cmp eax, 0xffffff88
ja 0x45adf1
cmp dword [esp + 0x80], 0
lea edx, [eax + esi]
je 0x45adb5
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x74], eax
add eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x28]
mov esi, 1
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x70], esi
call fcn.00458670
cmp eax, 0xffffff88
jbe 0x45acd5
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
lea edx, [esp + 0x58]
push edx
mov eax, edi
lea edx, [esp + 0x4c]
call fcn.00458800
lea eax, [esp + 0x64]
add esp, 4
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
call fcn.00458800
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
add esp, 4
push ecx
lea edx, [esp + 0x4c]
call fcn.00458800
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00458770
cmp eax, 2
jg 0x45ada7
jmp 0x45ad35
mov esi, 1
cmp dword [esp + 0x80], 0
je 0x45adb5
sub dword [esp + 0x80], esi
lea edx, [esp + 0x3c]
push edx
lea esi, [esp + 0x4c]
call fcn.0045a820
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 4
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x28]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
push edx
mov eax, ebp
call fcn.0045aa20
add esp, 0x24
cmp eax, 0xffffff88
ja 0x45adf1
mov ecx, esi
add ebp, eax
call fcn.00458770
cmp eax, 2
jle 0x45ad30
cmp dword [esp + 0x80], 0
jne 0x45acc8
mov eax, dword [esp + 0x18]
mov esi, ebx
sub esi, eax
cmp eax, ebx
ja 0x45acc8
lea ecx, [esi + ebp]
cmp ecx, dword [esp + 0x1c]
jbe 0x45addb
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
push esi
push eax
push ebp
call fcn.005e4a90
mov eax, esi
sub eax, dword [esp + 0x90]
add esp, 0xc
add eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x45e780
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
xor ebp, ebp
cmp ebx, ebp
jne 0x45e791
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x10]
push esi
push 0x54
cmp eax, ebp
je 0x45e7b3
mov ecx, dword [esp + 0x20]
push ecx
call eax
push 0x54
mov esi, eax
push ebp
push esi
call fcn.005e4a10
add esp, 0x14
jmp 0x45e7bf
push 1
call fcn.005ea8f6
add esp, 8
mov esi, eax
cmp esi, ebp
jne 0x45e7c9
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
mov edi, 1
mov dword [esi + 0x24], edi
mov eax, dword [esp + 0x18]
push 8
cmp eax, ebp
je 0x45e7e8
mov edx, dword [esp + 0x24]
push edx
call eax
add esp, 8
jmp 0x45e7f0
call fcn.005e2960
add esp, 4
mov dword [esi + 0x18], eax
lea eax, [esi + 0x30]
push eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea ecx, [esi + 0x48]
push ecx
call edi
lea edx, [esi + 0x4c]
push edx
call edi
lea eax, [ebx + ebx*2]
add eax, eax
mov dword [esi + 0x50], ebp
mov ecx, dword [esp + 0x18]
add eax, eax
push eax
cmp ecx, ebp
je 0x45e83a
mov eax, dword [esp + 0x24]
push eax
call ecx
add esp, 8
jmp 0x45e842
call fcn.005e2960
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov edx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], ecx
cmp eax, ebp
je 0x45e8c3
cmp dword [esi + 0x18], ebp
je 0x45e8c3
cmp ebx, ebp
jbe 0x45e8b3
xor ebx, ebx
jmp 0x45e870
mov edi, dword [esi + 0xc]
push 0
push 0
add edi, ebx
push edi
push 0x45f7c0
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x45e6b0
call fcn.005e17f7
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x45e8a5
call fcn.005e8493
cmp dword [eax], 0
jne 0x45e8c0
inc ebp
add ebx, 0xc
cmp ebp, dword [esp + 0x14]
jb 0x45e870
mov ebx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x10], ebp
mov eax, esi
call fcn.0045e970
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x45ea10
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, dword [esi + 0x10]
ja 0x45ea33
test ebp, ebp
jne 0x45ea29
lea eax, [ebp + 1]
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 8], eax
lea eax, [ebp + ebp*2]
add eax, eax
add eax, eax
push edi
push eax
test ecx, ecx
je 0x45ea55
push edx
call ecx
add esp, 8
jmp 0x45ea5d
call fcn.005e2960
add esp, 4
mov edi, eax
test edi, edi
jne 0x45ea6c
lea eax, [edi + 1]
pop edi
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
lea ecx, [eax + eax*2]
add ecx, ecx
add ecx, ecx
push ecx
push edx
push edi
call fcn.005e4a90
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
add esp, 0xc
test eax, eax
je 0x45eaac
push eax
test ecx, ecx
je 0x45eaa4
push edx
call ecx
add esp, 8
jmp 0x45eaac
call fcn.005e2aef
add esp, 4
push ebx
mov ebx, dword [esi + 0x10]
mov dword [esi + 0xc], edi
cmp ebx, ebp
jae 0x45eaf8
lea ecx, [ebx + ebx*2]
lea edi, [edi + ecx*4]
lea ecx, [ecx]
push 0
push 0
push edi
push 0x45f7c0
push 0
push 0
mov dword [edi + 8], esi
mov dword [edi + 4], 0x45e6b0
call fcn.005e17f7
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x45eaf0
call fcn.005e8493
cmp dword [eax], 0
jne 0x45eb07
inc ebx
add edi, 0xc
cmp ebx, ebp
jb 0x45eac0
pop ebx
pop edi
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
xor eax, eax
pop ebp
add esp, 0xc
ret
mov dword [esi + 0x10], ebx
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0xc
ret
Function at 0x47fdb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ace7
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x6fadcc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.00476a50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00476a50
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.00478be0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00478be0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00479510
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.00479510
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.004ac5e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.004ac660
movzx edx, al
test edx, edx
je 0x47fe8e
lea ecx, [ebp - 0x1bc]
call fcn.00477e60
push eax
lea ecx, [ebp - 0x134]
call fcn.00477e60
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x47ff6c
lea ecx, [ebp - 0x134]
call fcn.00476be0
test eax, eax
jg 0x47feb0
lea ecx, [ebp - 0x1bc]
call fcn.00476be0
test eax, eax
jle 0x47ff43
lea ecx, [ebp - 0x24c]
call fcn.00476a50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00476a50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.0047ffe0
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.0047ffe0
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.004774f0
push eax
lea ecx, [ebp - 0x24c]
call fcn.004774f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00476b60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00476b60
jmp 0x47ff6c
lea ecx, [ebp - 0x1bc]
call fcn.004774f0
push eax
lea ecx, [ebp - 0x134]
call fcn.004774f0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x47ff85
cmp dword [ebp + 0x10], 0
je 0x47ff85
mov ecx, dword [ebp + 0x10]
call fcn.004940f0
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.004ac640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00476b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.00476b60
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e0eb7
mov esp, ebp
pop ebp
ret
Function at 0x480110
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ad6c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x6fadcc]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00476a50
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00478be0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00479510
lea ecx, [ebp - 0x134]
call fcn.004ac5e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.004ac660
movzx ecx, al
test ecx, ecx
je 0x4801d8
lea ecx, [ebp - 0x94]
call fcn.00477e60
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ac640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00476b60
mov al, byte [ebp - 0x255]
jmp 0x4803ab
lea ecx, [ebp - 0x94]
call fcn.00476be0
cmp eax, 0x104
jle 0x4802de
lea ecx, [ebp - 0x1bc]
call fcn.00476a50
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.0047fa40
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00476a50
mov byte [ebp - 4], 3
push 0x65a784
lea ecx, [ebp - 0x24c]
call fcn.004786a0
lea ecx, [ebp - 0x1bc]
call fcn.004788c0
push eax
lea ecx, [ebp - 0x24c]
call fcn.004786a0
lea ecx, [ebp - 0x24c]
call fcn.004774f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x48027f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x48027f
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00476b60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00476b60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ac640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00476b60
mov al, byte [ebp - 0x256]
jmp 0x4803ab
lea ecx, [ebp - 0x94]
call fcn.004774f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x480351
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x48033e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00494190
lea ecx, [ebp - 0x94]
call fcn.004788c0
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x480351
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ac640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00476b60
mov al, byte [ebp - 0x257]
jmp 0x4803ab
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005e0eb7
mov esp, ebp
pop ebp
ret
Function at 0x481380
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60af21
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x6fadcc]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.00476be0
test eax, eax
jne 0x4813eb
cmp dword [ebp + 0x14], 0
je 0x4813e4
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x481554
lea ecx, [ebp - 0x94]
call fcn.00476a50
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00478be0
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00479510
lea ecx, [ebp - 0x94]
call fcn.00476be0
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.004ac5e0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x48149c
lea ecx, [ebp - 0x94]
call fcn.00477b40
movzx ecx, al
test ecx, ecx
jne 0x48146b
lea ecx, [ebp - 0x134]
call fcn.004ac660
movzx edx, al
test edx, edx
je 0x48149c
lea ecx, [ebp - 0x94]
call fcn.00477e60
push eax
call fcn.004831f0
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x481497
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x48151c
cmp dword [ebp - 0x138], 0
jle 0x4814f2
lea ecx, [ebp - 0x1c4]
call fcn.00476a50
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.0047ffe0
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00477510
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00476b60
jmp 0x481509
lea ecx, [ebp - 0x94]
call fcn.00477510
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x48151c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004ac640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00476b60
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005e0eb7
mov esp, ebp
pop ebp
ret