joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4086d9
pop dword [ebp - 0x20]
mov eax, 0x6dd39871
sub eax, 0x6d931198
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc395976
add dword [ebp - 0x30], 0x4218ebd5
mov dword [ebp - 0x2c], 0x191a6436
add dword [ebp - 0x2c], 0x1918e80f
mov dword [ebp - 0x28], 0xea750f29
sub dword [ebp - 0x28], 0x9e28cafb
mov dword [ebp - 0x24], 0xe32117e1
add dword [ebp - 0x24], 0x1cdee81f
lea eax, [ebp - 0x30]
push eax
mov eax, 0x1d2190e2
sub eax, 0x1ce0c08e
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x4017edd4
sub dword [ebp - 0x30], 0xcba5847e
mov dword [ebp - 0x2c], 0x9fb5361d
add dword [ebp - 0x2c], 0xa1b72b58
mov dword [ebp - 0x28], 0x6d6524e5
sub dword [ebp - 0x28], 0x9f5b879
mov dword [ebp - 0x24], 0xfceae218
add dword [ebp - 0x24], 0x3151de8
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38085
push 0
call eax
mov ecx, 0x3b6f8575
add ecx, 0xc490bc98
mov edi, eax
mov esi, 0x5fb06dfa
add esi, 0xa0914206
add esi, dword [ebp - 0x20]
mov ebx, 0x39326627
add ebx, 0xa7a9fe01
mov dword [ebp - 4], 0xdf30be7
mov edx, dword [esi]
add dword [ebp - 0x14], 0xa74c14b4
xor edx, ebx
mov dword [edi], edx
add edi, 0x9b5ce65d
add edi, 0x64a319a7
add esi, 0x413ebe0f
add esi, 0xbec141f5
loop 0x4087f6
add eax, 0xdc027823
add eax, 0x23fe82e4
mov ebx, eax
add eax, 0xefe2ac6
sub eax, 0xefe2ac1
mov ecx, 0x88bf80ca
add ecx, 0x77807f36
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x300010cc
Capabilities:
Terminate process

Disassembly:
call 0x300e3000
jmp 0x300011b3
push 0x58
push 0x300012c8
call fcn.300012f0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x30003044
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x3000175b
xor esi, esi
inc esi
mov eax, dword [0x30003040]
cmp eax, esi
je 0x30001779
mov eax, dword [0x30003040]
test eax, eax
jne 0x30001568
mov dword [0x30003040], esi
push 0x300012c0
push 0x300012b8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x3000181b
mov eax, dword [0x30003040]
cmp eax, esi
jne 0x3000125f
push 0x300012b4
push 0x300012ac
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x30003040], 2
test ebx, ebx
jne 0x3000126b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x30003050], 0
jne 0x30001786
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
nop
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x30001528
cmp al, 0x22
je 0x30001518
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
jne 0x300017bf
inc esi
jmp 0x30001280
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x30001295
test al, al
je 0x30001536
cmp dword [ebp - 0x1c], 0
jne 0x3000128d
mov al, byte [esi]
test al, al
je 0x30001546
cmp al, 0x20
ja 0x30001546
inc esi
mov dword [ebp - 0x20], esi
jmp 0x30001536
test byte [ebp - 0x3c], 1
jne 0x30001562
push 0xa
pop eax
push eax
push esi
push 0
push 0x30000000
call fcn.30001573
jmp 0x300017aa
movzx eax, word [ebp - 0x38]
jmp 0x3000154f
mov dword [0x30003058], esi
jmp 0x3000123b
cmp eax, esi
jne 0x30001769
xor esi, esi
inc esi
mov ebx, esi
jmp 0x30001202
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x300011ed
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x3000123b
push 0x30003050
call fcn.30001d69
pop ecx
test eax, eax
je 0x30001278
push 0
push 2
push 0
call dword [0x30003050]
jmp 0x30001278
mov dword [0x30003054], eax
cmp dword [0x30003020], 0
jne 0x300017f7
push eax
call dword [sym.imp.MSVCR80.dll_exit]
inc esi
mov dword [ebp - 0x20], esi
jmp 0x300012a8
cmp dword [0x30003058], 0
jne 0x30001806
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x30003054]
jmp 0x30001827
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.30001504
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x10abb50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10abb5a
pushal
call 0x10abb60
pop ebp
sub ebp, 0x10
sub ebp, 0xcabb50
jmp 0x10abb76
mov eax, 0xcabb50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0x656f7dcc
xor byte [eax], dl
inc eax
dec ecx
jne 0x10abb8d
jmp 0x10abba0
inc edi
add dword [edi + 0x45], eax
invalid
Function at 0x40c5b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b50a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40c66a
cmp byte [esi + 0x3d], 0
je 0x40c66a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40c658
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40c620
sub eax, 1
je 0x40c624
sub eax, 2
jne 0x40c658
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40c641
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004533a1
add esp, 0x10
cmp edi, eax
jne 0x40c658
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042feac
mov esp, ebp
pop ebp
ret

Function at 0x40f670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40f6a1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40f690
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4110a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494e85
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x4b50a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 0xc]
push edi
call fcn.00406280
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0043e9f0
mov eax, dword [ebp - 0x50]
add esp, 0xc
test eax, eax
je 0x411105
mov byte [ebp - 0x41], 0
cmp eax, 1
jne 0x411109
mov byte [ebp - 0x41], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x41114a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411140
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4112ab
push edx
push ecx
call fcn.0042fe99
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp byte [ebp - 0x41], al
je 0x4111a4
push 0x49a8e8
push 0x4b7408
call fcn.00401910
add esp, 8
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x41117f
mov ecx, dword [edi]
push dword [edi + 0x10]
push ecx
push eax
call fcn.004028b0
push str._file_doesnt_exist
push eax
call fcn.00401580
push eax
call fcn.00403d50
add esp, 0x18
xor al, al
jmp 0x411290
push str.Launching_Revealed_installer
push 0x4b7348
call fcn.00401580
add esp, 8
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x4111c0
mov ecx, dword [edi]
push dword [edi + 0x10]
lea edx, [edi + 0x10]
push ecx
push eax
mov dword [ebp - 0x48], edx
call fcn.004028b0
push eax
call fcn.00403d50
push 0x44
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.004467b0
add esp, 0x1c
lea ecx, [ebp - 0x40]
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
push esi
call fcn.00406280
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
mov eax, edi
cmovae ecx, dword [ebp - 0x40]
cmp dword [edi + 0x14], 8
jb 0x411215
mov eax, dword [edi]
lea edx, [ebp - 0x60]
push edx
lea edx, [ebp - 0xa4]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x411254
push dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
push str.Launched_Revealed_installer
push 0x4b7348
jmp 0x41125e
push str.Failed_to_install_Revealed_from
push 0x4b7408
call fcn.00401580
add esp, 8
mov ecx, eax
cmp dword [edi + 0x14], 8
jb 0x411270
mov edi, dword [edi]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
push eax
push edi
push ecx
call fcn.004028b0
push eax
call fcn.00403d50
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00406f80
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret
call fcn.00451c51
int3
Function at 0x411840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b50a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x411870
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4118ac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4118ac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x411992
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4118d4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x411907
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004528df
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x411965
sub eax, 1
je 0x411965
sub eax, 2
jne 0x411992
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004025f0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x411982
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004533a1
add esp, 0x10
cmp edi, eax
jne 0x411992
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x411897
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042feac
mov esp, ebp
pop ebp
ret 4
Function at 0x416d2c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4b50a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x416d51
xor eax, eax
jmp 0x416dad
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x416d7e
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x416d7e
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x416e34
cmp dword [edi + 0x4c], 0
je 0x416da7
mov ecx, edi
call fcn.00416893
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x416dbd
push dword [edi + 0x4c]
push ebx
call fcn.00416006
pop ecx
test al, al
movzx eax, bx
pop ecx
jne 0x416dac
mov eax, 0xffff
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0042feac
leave
ret 4
mov word [ebp - 0x28], bx
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x49a21c]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x416e07
sub eax, 1
je 0x416e07
dec eax
sub eax, 1
jne 0x416da7
push dword [edi + 0x4c]
push dword [ebp - 0x28]
jmp 0x416d99
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x416e24
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.004533a1
add esp, 0x10
cmp esi, eax
jne 0x416da7
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x34], eax
je 0x416da7
mov ax, bx
jmp 0x416dac
Function at 0x43ae60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498c5d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4b50a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov edx, 2
test esi, esi
mov eax, 1
cmove esi, eax
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00492f71
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
push ebx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x43aeeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43aeeb
push str.boost::filesystem::current_path
push dword [ebp + 0xc]
push eax
call fcn.00442120
add esp, 0xc
jmp 0x43af00
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43af00
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov esi, dword [ebp + 8]
mov ecx, ebx
xor eax, eax
mov dword [esi], 0
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43af21
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.0040f220
push ebx
call fcn.0042fea7
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e0d0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov cl, al
push ebx
mov ebx, eax
shr ebx, 4
and bl, 1
and cl, 1
push esi
mov esi, dword [esp + 0x10]
mov byte [esp + 0xb], cl
je 0x43e17d
and eax, 0xfffffffe
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x43e0ff
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x43e17d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43e211
cmp eax, 3
je 0x43e211
cmp eax, 0x7b
je 0x43e211
cmp eax, 0xf
je 0x43e211
cmp eax, 0x15
je 0x43e211
cmp eax, 0x57
je 0x43e211
cmp eax, 0xa1
je 0x43e211
cmp eax, 0x35
je 0x43e211
cmp eax, 0x43
je 0x43e211
push str.boost::filesystem::remove
push dword [esp + 0x1c]
push esi
push eax
call fcn.004420b0
add esp, 0x10
xor al, al
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [esi + 0x14]
mov eax, esi
test bl, bl
jne 0x43e196
cmp ecx, 8
jb 0x43e18d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x43e1a4
cmp ecx, 8
jb 0x43e19d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x43e217
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
je 0x43e210
cmp edi, 3
je 0x43e210
cmp edi, 0x7b
je 0x43e210
cmp edi, 0xf
je 0x43e210
cmp edi, 0x15
je 0x43e210
cmp edi, 0x57
je 0x43e210
cmp edi, 0xa1
je 0x43e210
cmp edi, 0x35
je 0x43e210
cmp edi, 0x43
je 0x43e210
cmp byte [esp + 0xf], 0
je 0x43e1fd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43e1f2
mov eax, dword [esi]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.boost::filesystem::remove
push dword [esp + 0x20]
push esi
push edi
call fcn.004420b0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
pop esi
mov al, 1
pop ebx
pop ecx
ret
Function at 0x43ed20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4991b5
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4b50a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov edx, edi
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
cmp dword [edi + 0x14], 8
jb 0x43ed61
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ed81
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040f220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2200000
push 3
push 0
push 7
push 0x88
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x43ee10
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x43ee02
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43eec6
push edx
push ecx
call fcn.0042fe99
add esp, 8
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x43ee8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp eax, 5
jne 0x43ee7c
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x43ee41
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ee71
test esi, 0x400
jne 0x43ee79
push esi
push edi
call fcn.0043c090
and esi, 0x10
mov dword [ebx + 4], eax
or esi, 0x20
add esp, 8
shr esi, 4
mov dword [ebx], esi
jmp 0x43eea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43ee7c
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x2c]
push edi
push eax
push ebx
call fcn.0043c830
add esp, 0x10
jmp 0x43eea8
push dword [ebp - 0x2c]
push edi
push esi
push ebx
call fcn.0043ea20
add esp, 0x10
push esi
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042feac
mov esp, ebp
pop ebp
ret
call fcn.00451c51
int3