joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd4f5
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, ebp
push edi
lea edi, [ebx + 0xac]
push edi
call fcn.004c87a7
xor edx, edx
test al, al
je 0x4dd51c
cmp word [ebp + 0x10], dx
jne 0x4dd621
cmp dword [ebx + 4], 0xffffffff
push esi
push 5
pop ecx
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
je 0x4dd534
push edx
mov ecx, ebx
call fcn.0047627a
xor edx, edx
push edx
push edx
push 2
lea eax, [ebx + 0xac]
push eax
call fcn.00464567
movzx eax, al
mov ecx, ebx
neg eax
sbb eax, eax
and eax, 0xffffffeb
add eax, 0x17
push eax
call fcn.004778a4
cmp dword [ebx + 4], 0xffffffff
je 0x4dd620
push ebp
mov ecx, ebx
call fcn.00475e2a
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x4dd592
call edi
mov esi, eax
push esi
call fcn.004745c8
push eax
push esi
push ebp
push str.UDP_port_bind_failed__A:___d___s
call fcn.00479c3c
add esp, 0x10
jmp 0x4dd5a8
xor eax, eax
cmp word [ebp + 0x10], ax
jne 0x4dd5a8
mov ecx, ebx
call fcn.0047761d
mov word [ebx + 0xbc], ax
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x14]
push 4
push eax
push 0x1002
push 0xffff
push dword [ebx + 4]
mov ebp, 0x200000
mov dword [esp + 0x28], ebp
call esi
cmp eax, 0xffffffff
jne 0x4dd5e6
call edi
push eax
push dword [esp + 0x18]
push str.UDP_setsockopt_SO_RCVBUF___d__failed:__d
call fcn.00479bc5
add esp, 0xc
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebp
push eax
push 0x1001
push 0xffff
push dword [ebx + 4]
call esi
cmp eax, 0xffffffff
jne 0x4dd619
call edi
push eax
push dword [esp + 0x18]
push str.UDP_setsockopt_SO_SNDBUF___d__failed:__d
call fcn.00479bc5
add esp, 0xc
mov ecx, ebx
call fcn.00477018
pop esi
pop edi
pop ebp
pop ebx
ret 4

Function at 0x4dd9cc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4dda1f
push esi
push edi
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.004c86b9
mov edi, dword [ebp + 0x18]
lea esi, [ebp - 0x18]
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4ddddc
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1bc]
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], ebx
movzx eax, word [esi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c0]
movzx ebp, ax
test ecx, ecx
je 0x4dde3e
mov ebx, ecx
mov byte [esp + 0x27], 3
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4dde19
sub ebx, edx
lea eax, [esp + 0x29]
push ebx
push ecx
push eax
mov byte [esp + 0x34], bl
call fcn.0064fe80
add esp, 0xc
mov word [esp + ebx + 0x29], bp
xor ebx, ebx
jmp 0x4dde6f
push esi
call fcn.00464567
test al, al
je 0x4dde5b
mov eax, dword [esi + 0xc]
mov byte [esp + 0x27], 1
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], bp
jmp 0x4dde6f
push edi
mov byte [esp + 0x2b], 4
lea edi, [esp + 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [esp + 0x3c], bp
pop edi
lea eax, [esp + 0x24]
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.004ddf12
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
add ecx, 0x118
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.0047752e
push ebx
push ebx
push dword [esp + 0x18]
lea eax, [esp + 0x138]
mov dword [esp + 0x18], ebx
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x1d0]
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
test esi, esi
jne 0x4ddeea
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
cmp esi, eax
je 0x4ddf06
lea ecx, [esp + 0x24]
call fcn.004ddf12
cmp esi, eax
jg 0x4ddf02
xor eax, eax
jmp 0x4ddf06
sub esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1a0
ret 0x14

Function at 0x4de0da
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x7a70a0], 0
je 0x4de0f0
mov al, 1
jmp 0x4de128
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4de126
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x4de120
shr eax, 8
cmp al, 2
jne 0x4de120
mov byte [0x7a70a0], 1
jmp 0x4de0ec
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4e8461
Capabilities:
Encode data using xor

Disassembly:
push ebp
sub esp, 0x18
mov eax, 0x69d8cc
call fcn.006375a8
sub esp, 0xf0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp + 0x18], esi
mov ebx, dword [esi + 0x35c]
call fcn.004e860c
mov esi, dword [esi + 0x140]
lea edi, [ebp + 4]
push 5
pop ecx
mov dword [ebp], 0x32716572
add esi, 8
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xfc]
call fcn.004683d2
and dword [ebp - 4], 0
lea eax, [ebp]
push 0x18
push eax
lea ecx, [ebp - 0xfc]
call fcn.0046836e
push 5
pop ecx
mov esi, eax
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 5
pop ecx
mov esi, ebx
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, edi
mov eax, dword [ebx + ecx + 0x14]
xor dword [ebp + ecx - 0x74], eax
add ecx, 4
cmp ecx, 0x14
jb 0x4e84c6
movzx eax, byte [0x77d8ac]
mov esi, dword [ebp + 0x18]
mov ecx, esi
shr eax, 2
not eax
mov dword [ebp - 0x58], edi
and eax, 1
mov dword [ebp - 0x60], edi
or al, 2
mov dword [ebp - 0x5c], edi
mov byte [ebp - 0x55], al
mov byte [ebx], al
lea eax, [ebp - 0x50]
push dword [esi + 0x140]
mov dword [ebp - 0x54], 0x44000000
push eax
call fcn.004e26ff
mov eax, dword [esi + 0x140]
mov ecx, esi
push 0x14
add eax, 8
push eax
call fcn.004e9a4e
lea eax, [ebx + 0xc]
push eax
push 0x54
lea eax, [ebp - 0x60]
push eax
call fcn.00571ec7
lea eax, [ebx + 0x114]
mov dword [ebx + 5], edi
push eax
lea ecx, [ebx + 1]
push 8
push ecx
mov dword [ecx], edi
call fcn.00571ec7
push edi
push 0x7c
lea eax, [ebp - 0x88]
mov ecx, esi
push eax
call fcn.004784ee
lea ecx, [ebp - 0xfc]
call fcn.0040c884
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
lea esp, [ebp + 0x1c]
pop ebp
ret

Function at 0x4ef3f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x69dc55
call fcn.006375a8
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebx], 0x6d6f8c
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x14]
push 5
pop ecx
lea esi, [ebp + 0xc]
mov byte [ebp - 4], 1
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebx + 0x10], eax
push edi
call fcn.00492906
mov ecx, eax
mov esi, edx
mov eax, dword [0x7a0024]
cdq
add ecx, eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x28], ecx
adc esi, edx
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], 0xea60
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
lea esi, [ebx + 0x4c]
mov dword [esi], 0x6d6e84
push str.share
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.00470d99
push esi
push eax
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 4
call fcn.005401ef
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.004267c2
push 0x1388
call fcn.0045e489
mov ecx, ebx
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x8c], edi
call fcn.004f0646
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4f1847
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x140], 0
jne 0x4f18bc
mov ebx, 0x100
cmp dword [esi + 0x15c], ebx
jae 0x4f18bc
lea edx, [esi + 0x144]
mov byte [esi + 0x140], 1
xor eax, eax
mov edi, edx
push edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0x158]
mov ecx, dword [esi + 0x15c]
sub ebx, ecx
mov edx, dword [esi]
mov edi, dword [esp + 0x14]
push eax
lea eax, [esi + 0x160]
mov dword [esi + 0x154], edi
add eax, ecx
mov ecx, esi
push ebx
push eax
call dword [edx + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4f18c4
push edi
mov byte [esi + 0x140], 0
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov al, 1
pop edi
pop esi
pop ebx
ret 4
xor al, al
jmp 0x4f18be
Function at 0x501e36
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x69ecb2
call fcn.006375a8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x501e5f
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
jmp 0x501e63
mov eax, ebx
mov edx, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x34]
push 7
pop edi
mov dword [esi + 4], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x501ea2
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
lea eax, [esi + 0x4c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x501eb7
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov al, byte [ebp + 0x2c]
mov byte [esi + 0x65], al
mov al, byte [esi + 0x66]
and al, 0xe1
mov byte [esi + 0x64], 8
or al, 0x40
mov word [esi + 0x67], bx
mov byte [esi + 0x66], al
lea eax, [esi + 0x6c]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], ebx
cmp edi, 8
jb 0x501ee4
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ecx
mov byte [esi + 0x90], bl
mov dword [esi + 0x94], ebx
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00502788
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0042615e
mov ecx, esi
call fcn.00504473
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov ecx, dword [esi + 0x8c]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x501f5f
push esi
lea eax, [ebp - 0x40]
push eax
call fcn.0050344a
push eax
lea ecx, [ebp - 0x28]
call fcn.0042623d
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004267c2
lea eax, [ebp - 0x28]
push eax
call fcn.0045f4a7
test al, al
je 0x501f8c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x501f78
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
shl al, 5
xor al, byte [esi + 0x66]
and al, 0x20
xor byte [esi + 0x66], al
jmp 0x501f90
and byte [esi + 0x66], 0xdf
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.004267c2
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x502a56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x6ab3b7
call fcn.006375a8
sub esp, 0x18
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x9c
mov eax, dword [edi + 8]
sub eax, dword [edi + 4]
cdq
idiv ecx
test eax, eax
je 0x502b13
push esi
xor esi, esi
mov eax, dword [edi + 4]
mov ecx, edi
add eax, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0050344a
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x502aa3
lea eax, [ebp - 0x24]
push eax
call fcn.0045f4bc
test al, al
jne 0x502ab7
mov eax, dword [edi + 4]
and byte [esi + eax + 0x66], 0xdf
jmp 0x502ae9
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x502ac3
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x502ae1
mov ecx, dword [edi + 4]
shl al, 5
xor al, byte [esi + ecx + 0x66]
and al, 0x20
xor byte [esi + ecx + 0x66], al
jmp 0x502ae9
mov eax, dword [edi + 4]
or byte [esi + eax + 0x66], 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
push 0
push 1
call fcn.004267c2
mov eax, dword [edi + 8]
mov ecx, 0x9c
sub eax, dword [edi + 4]
inc ebx
cdq
add esi, ecx
idiv ecx
cmp ebx, eax
jb 0x502a82
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x502e73
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
sub esp, 0x64
mov eax, 0x69edc1
call fcn.006375a8
sub esp, 0x30
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [ecx + 8]
cmp esi, edi
je 0x50303e
add ecx, 0x28
mov dword [ebp + 0x48], ecx
push ebx
push 0
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [ebp]
push eax
call fcn.0045e68f
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x502eb7
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x4c]
call fcn.00427f43
push 0
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004267c2
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
mov ebx, ecx
cmp edx, 8
jae 0x502ee0
lea ebx, [ebp + 0x4c]
mov eax, dword [ebp + 0x5c]
sub eax, dword [esi + 0x44]
lea ebx, [ebx + eax*2]
add ebx, 0xfffffffe
mov dword [ebp + 0x64], ebx
cmp edx, 8
jae 0x502ef7
lea ecx, [ebp + 0x4c]
push 0x5c
push ecx
call fcn.006523db
pop ecx
pop ecx
cmp eax, ebx
jb 0x50301c
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x502f1a
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x503011
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
jne 0x503011
push str.thumbs.db
lea ecx, [ebp + 0x30]
call fcn.00427f43
push 0
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0045e68f
cmp dword [eax + 0x14], 8
jb 0x502f66
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x24]
push 0
push 1
setne bh
call fcn.004267c2
push 0
push 1
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 2
call fcn.004267c2
push str..DS_Store
lea ecx, [ebp + 0x18]
call fcn.00427f43
push 0
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0045e68f
cmp dword [eax + 0x14], 8
jb 0x502fba
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x3c]
push 0
push 1
setne bl
call fcn.004267c2
push 0
push 1
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 2
call fcn.004267c2
test bh, bh
jne 0x502fea
test bl, bl
je 0x50301c
cmp dword [ebp + 0x60], 8
mov eax, dword [ebp + 0x4c]
jae 0x502ff6
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x50300e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x91
je 0x50301c
mov ebx, dword [ebp + 0x64]
mov edx, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x4c]
jmp 0x502eef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x4c]
push 0
push 1
call fcn.004267c2
mov ecx, dword [ebp + 0x48]
add esi, 0x9c
cmp esi, edi
jne 0x502e9b
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
lea esp, [ebp + 0x68]
pop ebp
ret
Function at 0x50304f
Capabilities:
Delete file

Disassembly:
mov eax, 0x69ee09
call fcn.006375a8
sub esp, 0x78
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0045f4bc
test al, al
je 0x5031ec
push ebx
xor ebx, ebx
push esi
cmp byte [ebp + 0xc], bl
je 0x503151
push edi
call fcn.0045f39f
mov esi, eax
test esi, esi
je 0x5031ea
call fcn.00490bdb
push eax
push 0x21
lea ecx, [ebp - 0x1c]
call fcn.00490637
push edi
push str.fileName
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00464a5c
push esi
push str.error
lea ecx, [ebp - 0x1c]
call fcn.00464a5c
lea eax, [ebp - 0x1c]
push eax
call fcn.0049240b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004906e8
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.00485eae
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.00442ae6
push eax
xor esi, esi
lea eax, [ebp - 0x3c]
push str._to_trash_:1___error_code_:
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.00426f87
push ebx
push esi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 3
call fcn.0040daff
push str.deletefail
lea ecx, [ebp - 0x24]
call fcn.0040d4cf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x21
call fcn.00485ab0
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.0040daff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push ebx
push esi
call fcn.0040daff
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x5031ea
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push esi
push edi
push str.Warning:_Delete_to_trash_failed_for__S._Error:__d._Deleting_permanently.
push 0x800
call fcn.00485eae
add esp, 0x10
lea eax, [ebp - 0x84]
push esi
push eax
call fcn.00473935
push eax
push str._to_trash_:0___error_code_:
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 5
push eax
call fcn.00426f87
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.0040daff
push str.deletefail
lea ecx, [ebp - 0x54]
call fcn.0040d4cf
push ebx
push ebx
push ebx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x21
call fcn.00485ab0
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.0040daff
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.0040daff
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x503b2b
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x503bbd
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x503bac
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0050344a
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x503b73
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
or eax, 1
cmp dword [esp + 0x24], 8
jae 0x503b8c
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.004267c2
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x503b4c
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret

Function at 0x503bc6
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, 0x9c
mov bl, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 4]
cdq
idiv ecx
test eax, eax
je 0x503c58
push edi
xor edi, edi
mov eax, dword [esi + 4]
add eax, edi
test byte [eax + 0x66], 0x20
jne 0x503c47
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0050344a
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x503c0e
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [esp + 0x10]
and eax, 0xfffffffe
cmp dword [esp + 0x24], 8
jae 0x503c27
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
lea ecx, [esp + 0x10]
push 0
sbb al, al
push 1
and bl, al
call fcn.004267c2
mov ecx, 0x9c
mov eax, dword [esi + 8]
inc ebp
sub eax, dword [esi + 4]
add edi, ecx
cdq
idiv ecx
cmp ebp, eax
jb 0x503be7
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret
Function at 0x503f70
Capabilities:
Move file

Disassembly:
mov eax, 0x6ab3b7
call fcn.006375a8
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
call fcn.00502bc7
imul ecx, dword [ebp + 8], 0x9c
mov eax, dword [ebx + 4]
add eax, ecx
mov dword [ebp + 8], ecx
push eax
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.0050344a
and dword [ebp - 4], edi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503fb4
lea eax, [ebp - 0x24]
push eax
call fcn.0045f4bc
mov esi, dword [ebp + 0xc]
test al, al
je 0x503fef
cmp dword [esi + 0x14], 8
jb 0x503fcb
mov ecx, dword [esi]
jmp 0x503fcd
mov ecx, esi
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x503fd9
lea eax, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x503fef
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
jmp 0x504008
sub esp, 0x18
mov ecx, esp
push esi
call fcn.0042615e
mov eax, dword [ebx + 4]
mov ecx, ebx
add eax, dword [ebp + 8]
push eax
call fcn.005044ca
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x504029
Capabilities:
Move file

Disassembly:
mov eax, 0x69ee7e
call fcn.006375a8
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
xor ebx, ebx
push ebx
call fcn.00502bc7
mov al, byte [esi + 0x89]
mov ecx, esi
test al, al
jne 0x5040b4
call fcn.00504e15
mov edi, 0x70000001
test al, al
je 0x50408a
mov edx, dword [esi + 4]
lea ecx, [esi + 0x28]
push 1
mov al, byte [edx + 0x66]
shr al, 2
and al, 1
movzx eax, al
push eax
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [edx + 0x34]
push eax
push dword [ebp + 0x20]
call fcn.00503c61
mov ebx, eax
jmp 0x50408c
mov ebx, edi
test ebx, ebx
je 0x504098
cmp ebx, edi
jne 0x5041b2
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x20]
call fcn.0042615e
push dword [esi + 4]
mov ecx, esi
call fcn.005044ca
jmp 0x504198
call fcn.00504e15
test al, al
je 0x504193
and dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
jae 0x5040e1
lea eax, [ebp + 8]
lea edi, [esi + 0x28]
cmp dword [edi + 0x14], 8
jb 0x5040ee
mov ecx, dword [edi]
jmp 0x5040f0
mov ecx, edi
push eax
push ecx
push str.Moving_files_from__s_to__s
call fcn.00479c3c
mov ecx, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 8
jae 0x50410b
lea ecx, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x504115
mov eax, dword [edi]
jmp 0x504117
mov eax, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x50413f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x504151
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.00504204
mov ebx, eax
test ebx, ebx
jne 0x504185
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.004267c2
jmp 0x504198
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x50415d
lea eax, [ebp + 8]
push eax
call fcn.00460273
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x50416f
lea eax, [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x504177
mov edi, dword [edi]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x50413f
jmp 0x50412e
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004267c2
jmp 0x5041b2
mov ebx, 0x70000001
call fcn.00475cf1
lea eax, [ebp + 8]
lea ecx, [esi + 0x28]
push eax
call fcn.0042623d
mov byte [ebp - 4], 2
call fcn.00475d32
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004267c2
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c