joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x14], 1
mov esi, 0x104
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x10], esi
push eax
mov edi, ecx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x220]
add esp, 0xc
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e330
test eax, eax
js 0x4080fe
push 0x24
pop ecx
call fcn.0040dc10
mov esi, eax
test esi, esi
je 0x41af2e
mov ecx, esi
mov dword [esi], edi
call fcn.00408e6e
mov eax, dword [esi + 0x18]
mov ecx, 0xffce
mov ebx, dword [esi]
mov edi, dword [esi + 0xc]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], ebx
call fcn.0040dc10
test eax, eax
je 0x41af2e
push 0
mov edx, 0x7fe7
mov dword [0x435794], eax
mov ecx, eax
call fcn.00408deb
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41af05
mov edx, dword [ebp - 0x10]
push ebx
call fcn.00411c55
test eax, eax
jne 0x4080fe
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41af10
push 0x5c
pop eax
mov edx, eax
call fcn.00410145
xor ecx, ecx
mov word [eax + 2], cx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41af1b
push eax
mov ecx, 0x447be0
call fcn.0040a586
test edi, edi
je 0x40812a
movzx eax, word [edi]
push 0x3a
pop edx
cmp ax, dx
je 0x40812a
push 0x5c
pop ecx
cmp ax, cx
jne 0x4080ce
cmp edi, ebx
je 0x41af26
mov eax, ebx
xor ecx, ecx
cmp word [eax], cx
je 0x4080b6
mov ecx, eax
add eax, 2
cmp eax, edi
jne 0x4080a6
movzx eax, word [ecx]
cmp ax, dx
je 0x41af26
push 0x5c
pop ecx
cmp ax, cx
je 0x41af26
movzx ebx, word [edi]
xor eax, eax
push dword [ebp - 0x224]
mov word [edi], ax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408126
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x435798], eax
mov word [edi], bx
cmp dword [0x435798], 0
je 0x40812a
xor esi, esi
inc esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x408115
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ad0
leave
ret
xor eax, eax
jmp 0x4080ed
mov ecx, esi
call fcn.00408e6e
mov eax, dword [ebp - 0x228]
mov dword [esi + 0x18], eax
jmp 0x408101
lea ecx, [ebp - 0x220]
jmp 0x40803b
lea ecx, [ebp - 0x220]
jmp 0x408057
lea eax, [ebp - 0x220]
jmp 0x408072
add edi, 2
jmp 0x4080ce
call fcn.00429762
push 1
push 0x43fa20
call dword [sym.imp.msvcrt.dll_longjmp]
int3
Function at 0x408deb
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0xc], eax
cmp word [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x408e2b
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
call fcn.00416ad0
mov esp, ebp
pop ebp
ret 4
push 0x3d
pop eax
push dword [ebp + 8]
mov word [esp + 0x10], ax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esp + 0xe], ax
lea ecx, [esp + 0xc]
push 0x3a
pop eax
mov word [esp + 0x10], ax
xor eax, eax
mov word [esp + 0x12], ax
call fcn.0040eb6e
test eax, eax
je 0x41b623
push eax
mov edx, edi
mov ecx, esi
call fcn.0040f2e0
jmp 0x408e16
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
mov word [esi], ax
push 0x3a
pop eax
mov word [esi + 2], ax
push 0x5c
pop eax
mov word [esi + 4], ax
xor eax, eax
mov word [esi + 6], ax
inc eax
jmp 0x408e18
Function at 0x409a7b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x44803c], 0
pop ecx
mov dword [ebp - 4], eax
jne 0x41bf50
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ecx, 0x2000
cmp esi, ecx
ja 0x41bf63
test esi, esi
je 0x409af1
push eax
push eax
push ecx
push 0x4397e0
push 0xffffffffffffffff
push ebx
push eax
push dword [0x431590]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
lea esi, [eax - 1]
push esi
push 0x4397e0
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409b00
cmp dword [edi], esi
jne 0x409b00
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x409af9
push 0
push dword [ebp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
jmp 0x409afa
push eax
push eax
push ecx
push 0x4397e0
push 0x1000
push ebx
push eax
push dword [0x431590]
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
push 0
push edi
push eax
push 0x4397e0
push dword [ebp - 4]
mov ecx, 0x2000
mov dword [ebp - 8], eax
add ebx, ecx
sub esi, ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x409b00
mov eax, dword [ebp - 8]
cmp dword [edi], eax
jne 0x409b00
push 0
pop eax
jmp 0x409aab
Function at 0x40a891
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
mov byte [0x4355b6], bl
push esi
test edx, edx
je 0x40a8bd
mov esi, edx
push edi
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40a8a7
sub esi, edi
sar esi, 1
neg esi
pop edi
sbb esi, esi
and edx, esi
push edx
push ecx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
push dword [0x431584]
mov esi, eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
call fcn.0040a8ef
mov dword [0x431584], eax
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
ret

Function at 0x40a8ef
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x40a934
push ebx
mov ecx, esi
call fcn.0040a940
mov ebx, eax
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40a92c
push ebx
push esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ac46
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
je 0x40ac60
cmp dword [0x435738], 0
je 0x40ac65
pop edi
pop esi
pop ebx
leave
ret
cmp dword [0x435748], 0
jne 0x40ac60
jmp 0x41ca2f
mov ecx, 0x20c
call fcn.0040dc10
mov edi, eax
test edi, edi
je 0x40ac60
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
mov edx, eax
test edx, edx
je 0x40ac60
and dword [ebp - 8], 0
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41ca62
mov eax, dword [0x435708]
sub ecx, esi
sar ecx, 1
add edx, 0xa
add eax, ecx
mov ecx, edi
add eax, edx
mov dword [ebp - 4], eax
lea edx, [eax + eax]
call fcn.0040dc60
mov esi, eax
test esi, esi
je 0x41caf1
cmp byte [0x43574c], 0
mov edi, esi
mov edx, dword [ebp - 4]
je 0x41cab1
mov eax, dword [0x435708]
sub edx, eax
push ebx
lea ecx, [esi + eax*2]
call fcn.0040f2e0
jmp 0x41caea
push 0x403edc
mov ecx, esi
call fcn.0040fb80
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x41cac2
sub ecx, edx
mov edx, dword [ebp - 4]
sar ecx, 1
mov dword [0x435708], ecx
mov ecx, esi
push ebx
call fcn.0040fb80
mov byte [0x43574c], 1
push esi
call dword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov ecx, edi
call fcn.0040dba0
jmp 0x40ac60
Function at 0x40eb6e
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42d580
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42d580], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40eba4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x435745], 0
je 0x40ec5d
push 0x402384
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40eca1
push 0x40238c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ec87
push 0x4023c8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ecbf
push 0x4023b0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41dcb0
push 0x4023a4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ecb1
push 0x4023e4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ec64
push 0x40249c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41dcbb
push 0x402470
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41dcc7
xor eax, eax
jmp 0x40eb9d
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.0040925d
add eax, eax
cmp eax, 0x4000
jae 0x40ecc3
xor ecx, ecx
mov word [eax + 0x42d580], cx
jmp 0x40eb9b
push dword [0x4355cc]
push 0x402040
push ebx
push edi
call fcn.004099ff
add esp, 0x10
jmp 0x40eb9b
push 0
mov edx, ebx
mov ecx, edi
call fcn.00408deb
jmp 0x40eb9b
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.004067a1
jmp 0x40ec70
push 2
jmp 0x40ec8d
call fcn.00416c18
int3
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
jmp 0x40eb9d
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x40ec8d
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
push dword [esp + 0xc]
jmp 0x40ec8d
Function at 0x410039
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
mov byte [ebp - 0xc], 1
xor ebx, ebx
mov dword [ebp - 8], esi
push esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x10], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x218]
add esp, 0xc
cmp byte [ebp - 0xc], al
sete al
dec eax
and eax, 0x7ee3
add eax, esi
push eax
call fcn.0040e330
test eax, eax
js 0x41e4db
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41e4ed
push dword [ebp - 8]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
mov esi, 0x4024f0
mov ecx, esi
call fcn.0040eb6e
test eax, eax
je 0x41e4f8
mov esi, 0x4024e0
mov ecx, esi
call fcn.0040eb6e
test eax, eax
je 0x41e509
mov esi, 0x4024d0
mov ecx, esi
call fcn.0040eb6e
test eax, eax
je 0x41e51a
mov ecx, 0x4024c0
call fcn.0040eb6e
test eax, eax
je 0x41e52b
mov ecx, 0x4024b4
call fcn.0040eb6e
test eax, eax
jne 0x41e5da
mov ecx, dword [0x447de8]
test ecx, ecx
je 0x41013e
xor edx, edx
inc edx
call fcn.00408b14
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
pop esi
pop ebx
test eax, eax
je 0x410132
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416ad0
leave
ret
mov ecx, 0x447be0
jmp 0x410116
push ebx
call fcn.00411df0
test eax, eax
je 0x41e4db
push 1
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [ebp - 0x218]
jmp 0x4100a1
mov edx, 0x4020a8
mov ecx, esi
call fcn.0040a891
jmp 0x4100c0
mov edx, 0x403a10
mov ecx, esi
call fcn.0040a891
jmp 0x4100d4
mov edx, 0x403c2c
mov ecx, esi
call fcn.0040a891
jmp 0x4100e8
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x41e538
lea ecx, [ebp - 0x218]
push 0x2e
pop edx
call fcn.0040a574
test eax, eax
jne 0x41e5be
push 0x403a5e
call dword [sym.imp.msvcrt.dll__wcsupr]
pop ecx
mov ecx, dword [ebp - 0x10]
mov esi, ecx
test ecx, ecx
jne 0x41e55f
lea esi, [ebp - 0x218]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x41e562
sub esi, edx
sar esi, 1
push edi
mov edi, ecx
test ecx, ecx
jne 0x41e580
lea edi, [ebp - 0x218]
mov ecx, edi
push 0x5c
pop edx
call fcn.00410145
lea ecx, [edi - 2]
lea ecx, [ecx + esi*2]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
pop edi
je 0x41e5a7
test ecx, ecx
jne 0x41e5a0
lea ecx, [ebp - 0x218]
push 0x403a5c
jmp 0x41e5b6
test ecx, ecx
jne 0x41e5b1
lea ecx, [ebp - 0x218]
push 0x403a5e
mov edx, dword [ebp - 8]
call fcn.0040fb80
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x41e5cb
lea edx, [ebp - 0x218]
mov ecx, 0x4024c0
call fcn.0040a891
jmp 0x4100fa
push 0x403c38
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41010c
mov dword [0x448508], 1
jmp 0x41010c
Function at 0x410a62
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00416ad0
leave
ret
Function at 0x412370
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x230], 0
mov eax, 0x104
push ebx
push esi
push edi
push eax
mov dword [ebp - 0x228], eax
xor ebx, ebx
lea eax, [ebp - 0x438]
inc ebx
push 0
push eax
mov esi, edx
mov byte [ebp - 0x22c], bl
mov edi, ecx
call sub.msvcrt.dll_memset
and dword [ebp - 0x18], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0x220]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x448], 0
add esp, 0xc
mov eax, 0x104
mov byte [ebp - 0x444], bl
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x650]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x438]
add esp, 0xc
cmp byte [ebp - 0x22c], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e330
test eax, eax
js 0x41f1b9
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e330
test eax, eax
js 0x41f1b9
xor eax, eax
lea ecx, [ebp - 0x220]
cmp byte [ebp - 0x14], al
sete al
dec eax
and eax, 0x7ee3
add eax, 0x104
push eax
call fcn.0040e330
test eax, eax
js 0x41f1b9
and dword [0x435798], 0
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x412493
lea eax, [ebp - 0x650]
push dword [ebp - 0x440]
mov edx, esi
mov ecx, edi
push eax
call fcn.00407cb5
test al, al
je 0x41252f
mov eax, dword [ebp - 0x448]
test eax, eax
jne 0x4124bb
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040a586
push 0x4024fc
lea ecx, [ebp - 0x220]
call fcn.004122ac
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x41f186
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41f191
push dword [ebp - 0x228]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x654]
push ecx
push edx
push edx
push edx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x41f19c
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x41257b
push 0x4025b8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x412583
xor bl, bl
cmp dword [ebp - 0x448], 0
jne 0x41f1c8
mov eax, dword [ebp - 0x18]
and dword [ebp - 0x18], 0
test eax, eax
je 0x412551
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, dword [ebp - 0x230]
and dword [ebp - 0x230], 0
test eax, eax
je 0x41256a
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ad0
leave
ret
lea eax, [ebp - 0x438]
jmp 0x41251d
cmp dword [ebp - 0x654], 0xc
je 0x412531
jmp 0x41252f
lea ecx, [ebp - 0x438]
jmp 0x4124e5
lea eax, [ebp - 0x220]
jmp 0x4124f0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea ecx, [eax - 0x90]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x435798], ecx
jmp 0x41252f
mov dword [0x435798], 8
jmp 0x41252f
push dword [ebp - 0x448]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x41253e
Function at 0x4146d9
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
test edx, 0x400
jne 0x420811
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x420811
cmp word [ebp - 0x24], di
ja 0x4207f7
mov eax, edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0x5040
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x14]
push 4
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x18
push eax
push 0x10000
lea eax, [ebp - 4]
mov dword [ebp - 0x30], 0x40
push eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x420811
mov ecx, dword [ebp - 4]
call fcn.004147a3
test eax, eax
jne 0x420802
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x420811
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
jmp 0x414722
mov ecx, dword [ebp - 4]
call fcn.00429f67
mov esi, eax
jmp 0x41478b
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x41479c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x41479c
Function at 0x414bc0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1a
mov edi, ecx
mov ecx, dword [edx + 0x20]
pop eax
mov word [ebp - 4], ax
test ecx, ecx
je 0x414bf1
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x420a00
inc dword [0x435704]
pop edi
pop esi
leave
ret 8
mov ecx, edx
jmp 0x414bd9
call fcn.00428981
test eax, eax
je 0x420a2e
mov ecx, esi
call fcn.0040dcd8
test eax, eax
jne 0x420a2e
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test edi, edi
je 0x420a6e
test byte [edi + 0x1c], 0x80
jne 0x420a6e
mov ecx, esi
call fcn.0040dcd8
test eax, eax
jne 0x420a6e
mov eax, dword [0x4356f4]
cmp eax, 3
je 0x420a6e
cmp dword [ebp + 0xc], 0
je 0x420a6e
cmp eax, 2
je 0x420a6e
push dword [ebp + 0xc]
push 0
push 0
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
mov ecx, esi
call fcn.0040a0ab
jmp 0x414be5

Function at 0x414c20
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push eax
push edi
push dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, ecx
mov dword [0x435790], eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x420aeb
mov ecx, dword [edi]
test ecx, ecx
je 0x420a9f
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
test eax, 0xc000
je 0x414c88
mov ecx, 0x8002
and eax, ecx
cmp eax, ecx
je 0x420ac3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x14
cmp ecx, 2
jb 0x414c97
mov ecx, 0xfeff
cmp word [ebx], cx
je 0x414ca1
or eax, 0x8000
mov dword [edx + 0x1c], eax
jmp 0x414c6f
or eax, 0x4000
jmp 0x414c9c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e3
je 0x420aeb
mov ecx, dword [edi]
test ecx, ecx
jne 0x414c62
and dword [0x435798], ecx
xor eax, eax
jmp 0x414c81
mov esi, dword [edi]
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, ebx
push edi
inc ecx
call fcn.004271ff
cmp esi, dword [edi]
je 0x414c7e
mov dword [0x435790], 1
jmp 0x414c7e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, esi
mov dword [0x435798], eax
call fcn.0040a0ab
mov ecx, dword [ebp + 0x14]
call fcn.0040dcd8
mov ecx, dword [ebp + 0x14]
mov esi, eax
call fcn.0040a0ab
test esi, esi
jne 0x420b1c
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [0x435798]
xor edx, edx
inc edx
call fcn.00428a90
int3
Function at 0x4151f3
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x10]
mov edi, ecx
push eax
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 4
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
cmp eax, 3
je 0x420eb7
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x420ed4
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00416ad0
leave
ret
cmp word [ebp - 0xa], 0x3a
jne 0x415225
cmp word [ebp - 8], 0x5c
jne 0x415225
xor eax, eax
jmp 0x415236
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 5
jne 0x415234
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415234
test al, 1
je 0x415234
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
je 0x415234
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
test eax, eax
je 0x420f22
xor esi, esi
jmp 0x415234
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
jmp 0x415234