joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
call fcn.0045d160
mov eax, dword [ebp - 4]
call fcn.004b4f50
dec eax
mov esi, eax
mov dword [ebp - 0xc], 0
cmp esi, dword [ebp - 0xc]
jl 0x45bffc
dec dword [ebp - 0xc]
nop
inc dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004582b0
mov ebx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004582b0
mov edi, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004582b0
mov dl, byte [edi + 0x19]
mov al, byte [eax + 0x1a]
xor dl, al
mov eax, ebx
mov cl, 0
call fcn.00459370
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004582b0
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 8]
call fcn.0045bf70
cmp esi, dword [ebp - 0xc]
jg 0x45bfa8
mov eax, dword [ebp - 8]
call fcn.0045d180
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
leave
ret
Function at 0x491c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0xd
call fcn.004088e0
mov dword [ebp - 8], 0
dec dword [ebp - 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00404c60
mov edx, dword [ebp - 8]
inc edx
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + 0x716070]
xor ecx, 0x79
mov byte [eax + edx - 1], cl
cmp dword [ebp - 8], 0xc
jl 0x491c50
leave
ret
Function at 0x499630
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], 0
push dword [ebp - 4]
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x4996c9
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x3c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x4996af
mov eax, 0x4995f0
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
push dword [ebp - 0x18]
call sub.user32.dll_EnumWindows
push dword [ebp - 8]
push dword [ebp - 0x10]
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4996ab
push 0
push dword [ebp - 0x10]
call sub.kernel32.dll_TerminateProcess
or eax, eax
setne al
mov byte [ebp - 0xc], al
jmp 0x4996af
mov byte [ebp - 0xc], 1
call fcn.0040d3b0
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
pop eax
test eax, eax
je 0x4996c9
dec eax
test eax, eax
call fcn.0040d520
mov al, byte [ebp - 0xc]
leave
ret
Function at 0x4b90d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4b90ef
mov dword [ebx + 0xc], 0
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4d1d40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x340], esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x34]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x4d1ef8
mov ebx, dword [ebp - 4]
mov eax, ebx
call fcn.00404c10
mov dword [ebx], 0
mov ebx, dword [ebp - 8]
mov eax, ebx
call fcn.00404c10
mov dword [ebx], 0
call sub.kernel32.dll_GetUserDefaultLCID
mov ebx, eax
push 4
lea eax, [ebp - 0xc]
push eax
push 3
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x4d1e38
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x23c]
push eax
push 3
push 0
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x33c]
mov edx, 0xff
call fcn.004050e0
lea eax, [ebp - 0x33c]
mov ecx, 2
mov edx, 1
call fcn.00405920
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x13c]
call fcn.00405d00
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x3c]
call fcn.00408640
mov eax, dword [ebp - 0x3c]
call fcn.00408320
mov esi, dword [ebp - 8]
mov eax, esi
call fcn.00404c10
mov eax, dword [ebp - 0x3c]
mov dword [esi], eax
push 4
lea eax, [ebp - 0xc]
push eax
push 7
push ebx
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
je 0x4d1ef8
lea eax, [ebp - 0x13c]
push eax
push 3
push 0
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x23c]
mov edx, 0xff
call fcn.004050e0
lea eax, [ebp - 0x23c]
mov ecx, 2
mov edx, 1
call fcn.00405920
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10]
call fcn.00408640
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc]
mov cl, 0
mov edx, 3
call fcn.00408720
mov eax, dword [ebp - 0x3c]
mov edx, 0x72f7b8
call fcn.00408880
test eax, eax
jne 0x4d1ed2
mov ebx, 0x72f7c4
lea eax, [ebp - 0x10]
call fcn.00404c10
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, 0x72f7d0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
mov ecx, 2
call fcn.004084c0
call fcn.0040d3b0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x10]
call fcn.00404c10
mov dword [ebp - 0x10], 0
pop eax
test eax, eax
je 0x4d1f25
call fcn.0040d520
mov ebx, dword [ebp - 0x344]
mov esi, dword [ebp - 0x340]
leave
ret
Function at 0x52ebe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov ebx, ecx
mov ecx, edx
mov dword [esp], eax
dec ebx
mov esi, ebx
mov edi, 0
cmp esi, edi
jl 0x52ec28
dec edi
nop
inc edi
mov al, byte [esp]
mov dl, byte [ecx]
xor dl, al
movzx eax, dl
mov ebx, eax
mov eax, dword [esp]
shr eax, 8
mov edx, dword [ebx*4 + 0x7d0020]
xor eax, edx
mov dword [esp], eax
inc ecx
cmp esi, edi
jg 0x52ec04
mov eax, dword [esp]
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x10
ret

Function at 0x536f20
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov esi, eax
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x536f5c
mov eax, esi
call fcn.0053b6a0
cmp byte [esi + 0x40], 0
je 0x536f55
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x536ffa
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x536fdb
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x536fd3
mov esi, esi
mov eax, dword [esi + 8]
test eax, eax
je 0x536f88
mov eax, esi
mov edx, dword [esi + 8]
mov edx, dword [edx]
call edx
mov eax, esi
mov edx, dword [esi + 0x184]
mov edx, dword [edx]
call edx
mov edi, eax
test eax, eax
jne 0x536f9e
mov bl, 0
jmp 0x536ffa
cmp edi, 2
je 0x536fd3
mov eax, dword [esi + 8]
test eax, eax
je 0x536f78
cmp edi, 3
je 0x536fb4
cmp edi, 1
jne 0x536f78
mov eax, dword [esi + 8]
inc dword [eax + 4]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x536f78
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
jmp 0x536f78
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x536ff1
mov eax, dword [esi + 0x14]
cmp eax, 0xcc
je 0x536ff1
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.005373c0
mov eax, esi
call fcn.00537010
mov bl, al
mov al, bl
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
Function at 0x537010
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
cmp eax, 0xcc
je 0x537102
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcc
jmp 0x537102
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
test eax, eax
je 0x537095
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x54]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x6c]
push 0
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x6c]
mov eax, dword [ebp - 4]
mov edx, 0
mov edi, dword [ebp - 4]
mov ebx, dword [edi + 0x178]
mov ebx, dword [ebx + 4]
call ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
cmp edx, esi
jne 0x5370c9
mov byte [ebp - 8], 0
jmp 0x537134
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6c]
mov eax, dword [ebp - 4]
cmp edx, dword [eax + 0x54]
jb 0x537060
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx + 4]
call edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x174]
mov edx, dword [ecx]
call edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
cmp byte [edx + 8], 0
jne 0x5370c9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x41], 0
je 0x537126
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xce
jmp 0x537130
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xcd
mov byte [ebp - 8], 1
mov al, byte [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
leave
ret
Function at 0x559310
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x344], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x134]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5594a1
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
mov edx, 0x748bac
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0040bec0
mov dword [ebp - 8], 0
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
mov edx, 0x748bac
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0040bec0
lea eax, [ebp - 0x110]
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 0xc]
sub ebx, 2
mov dword [ebp - 0x10], 1
cmp ebx, dword [ebp - 0x10]
jl 0x5594a1
dec dword [ebp - 0x10]
mov esi, esi
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 4
idiv ecx
cmp edx, 1
jne 0x559498
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x13c]
push eax
mov edx, 0x748bac
lea eax, [ebp - 4]
mov ecx, 1
call fcn.0040bec0
lea eax, [ebp - 0x140]
call fcn.00404c10
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x240]
push eax
push 0xfe
push 0
lea ecx, [ebp - 0x110]
lea eax, [ebp - 0x340]
mov edx, 0xff
call fcn.004050e0
lea eax, [ebp - 0x340]
mov edx, dword [ebp - 0x10]
mov ecx, 3
call fcn.00405920
lea eax, [ebp - 0x240]
lea edx, [ebp - 0x140]
call fcn.00408640
mov eax, dword [ebp - 0x140]
call fcn.00408320
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
dec esi
lea eax, [edi + esi*4]
call fcn.00404c10
mov eax, dword [ebp - 0x140]
mov dword [edi + esi*4], eax
cmp ebx, dword [ebp - 0x10]
jg 0x5593dc
call fcn.0040d3b0
lea eax, [ebp - 0x140]
call fcn.00404c10
mov dword [ebp - 0x140], 0
pop eax
test eax, eax
je 0x5594d2
mov edx, 0x748bac
lea eax, [ebp - 4]
call fcn.0040e1a0
call fcn.0040d520
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x34c]
mov esi, dword [ebp - 0x348]
mov edi, dword [ebp - 0x344]
leave
ret
Function at 0x5594f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
call fcn.00408320
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x559648
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
lea eax, [ebp - 0x38]
call fcn.00404c10
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00419530
mov eax, dword [ebp - 0x38]
call fcn.00408320
lea eax, [ebp - 4]
call fcn.00404c10
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x3c]
call fcn.00409310
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
call fcn.0040a610
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x44]
call fcn.00404c10
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x5595d2
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55960a
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55960a
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55960a
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x44]
mov edx, str.__
call fcn.00408350
jmp 0x559620
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x44]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0040bb30
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040a7d0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x559642
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
call fcn.0040d3b0
lea eax, [ebp - 0x44]
call fcn.00404c10
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x40]
call fcn.0040a610
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.00409310
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.00404c10
mov dword [ebp - 0x38], 0
lea eax, [ebp - 4]
call fcn.00404c10
pop eax
test eax, eax
je 0x55969b
call fcn.0040d520
leave
ret
Function at 0x5596a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov dword [ebp - 0x844], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x808], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 0
lea ecx, [ebp - 0x81c]
lea edx, [ebp - 0x834]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5597f4
mov dword [ebp - 0x810], 0x400
push dword [ebp - 0x810]
lea eax, [ebp - 0x804]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
mov cl, 1
mov edx, 0x3ff
call fcn.0040aa90
lea eax, [ebp - 0x83c]
call fcn.00404c10
mov dword [ebp - 0x83c], 0
lea eax, [ebp - 0x840]
call fcn.00404c10
mov dword [ebp - 0x840], 0
lea edx, [ebp - 0x840]
mov eax, dword [ebp - 0x808]
call fcn.0040a320
mov eax, dword [ebp - 0x840]
call fcn.00408320
lea eax, [ebp - 0x83c]
call fcn.00404c10
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x83c], eax
test eax, eax
je 0x559793
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x5597d4
mov eax, dword [ebp - 0x83c]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x5597d4
mov eax, dword [ebp - 0x83c]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x5597d4
mov ecx, dword [ebp - 0x83c]
mov eax, dword [ebp - 4]
mov edx, str.__
call fcn.00408350
jmp 0x5597f1
mov eax, dword [ebp - 0x83c]
call fcn.00408320
mov ebx, dword [ebp - 4]
mov eax, ebx
call fcn.00404c10
mov eax, dword [ebp - 0x83c]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
call fcn.0040d3b0
lea eax, [ebp - 0x840]
call fcn.00404c10
mov dword [ebp - 0x840], 0
lea eax, [ebp - 0x83c]
call fcn.00404c10
mov dword [ebp - 0x83c], 0
lea eax, [ebp - 0x808]
call fcn.00409310
mov dword [ebp - 0x808], 0
pop eax
test eax, eax
je 0x559842
call fcn.0040d520
mov ebx, dword [ebp - 0x844]
leave
ret
Function at 0x559dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x559ed1
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x559e43
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x559e7b
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x559e7b
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x559e7b
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x40]
mov edx, str.__
call fcn.00408350
jmp 0x559e91
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x40]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040bb30
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040a7d0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x559eb3
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x559ecd
mov eax, dword [ebp - 0xc]
and eax, 0x10
sete byte [ebp - 8]
jmp 0x559ed1
mov byte [ebp - 8], 0
call fcn.0040d3b0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
pop eax
test eax, eax
je 0x559f0d
call fcn.0040d520
mov al, byte [ebp - 8]
leave
ret
Function at 0x559f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55a06b
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x44]
call fcn.00404c10
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x48]
call fcn.00404c10
mov dword [ebp - 0x48], 0
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004195a0
mov eax, dword [ebp - 0x48]
call fcn.00408320
lea eax, [ebp - 0x44]
call fcn.00404c10
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x559fdd
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a015
mov eax, dword [ebp - 0x44]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a015
mov eax, dword [ebp - 0x44]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a015
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov edx, str.__
call fcn.00408350
jmp 0x55a02b
mov eax, dword [ebp - 0x44]
call fcn.00408320
lea eax, [ebp - 0x40]
call fcn.00404c10
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.0040bb30
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040a7d0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x55a04d
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x55a067
mov eax, dword [ebp - 0xc]
and eax, 0x10
seta byte [ebp - 8]
jmp 0x55a06b
mov byte [ebp - 8], 0
call fcn.0040d3b0
lea eax, [ebp - 0x48]
call fcn.00404c10
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x44]
call fcn.00404c10
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x40]
call fcn.00404c10
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.0040a610
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.00409310
mov dword [ebp - 0x38], 0
pop eax
test eax, eax
je 0x55a0c5
call fcn.0040d520
mov al, byte [ebp - 8]
leave
ret
Function at 0x55a0d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x2c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55a1c1
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x55a143
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a17b
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a17b
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a17b
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x3c]
mov edx, str.__
call fcn.00408350
jmp 0x55a191
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040bb30
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0040a7d0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x55a1b3
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_DeleteFileW
or eax, eax
setne al
mov byte [ebp - 8], al
call fcn.0040d3b0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x34]
call fcn.00409310
mov dword [ebp - 0x34], 0
pop eax
test eax, eax
je 0x55a1fd
call fcn.0040d520
mov al, byte [ebp - 8]
leave
ret
Function at 0x55a210
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x55a378
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x55a277
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a2af
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a2af
mov eax, dword [ebp - 8]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a2af
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x3c]
mov edx, str.__
call fcn.00408350
jmp 0x55a2c5
mov eax, dword [ebp - 8]
call fcn.00408320
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040bb30
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x55a2dc
mov eax, 0x7cbe60
push eax
lea eax, [ebp - 0x40]
call fcn.0040a610
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x55a305
mov eax, dword [eax - 4]
cmp eax, 2
jl 0x55a33d
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
cmp al, 0x3a
jne 0x55a33d
mov eax, dword [ebp - 4]
mov al, byte [eax]
call fcn.00405c60
and eax, 0xff
sub eax, 0x41
cmp eax, 0x1a
jae 0x55a33d
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x3c]
mov edx, str.__
call fcn.00408350
jmp 0x55a353
mov eax, dword [ebp - 4]
call fcn.00408320
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x40]
call fcn.0040bb30
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x55a36a
mov eax, 0x7cbe60
push eax
call sub.kernel32.dll_MoveFileW
or eax, eax
setne al
mov byte [ebp - 0xc], al
call fcn.0040d3b0
lea eax, [ebp - 0x40]
call fcn.0040a610
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x3c]
call fcn.00404c10
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
call fcn.0040a610
mov dword [ebp - 0x38], 0
pop eax
test eax, eax
je 0x55a3b4
call fcn.0040d520
mov al, byte [ebp - 0xc]
leave
ret