joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x41e779
mov dword [esi + 0x40], 0x6f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41e78e
push 1
lea eax, [ebp - 1]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x41e7a2
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [ebp - 1]
push 1
push edx
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
je 0x41e7b4
mov dword [esi + 0x40], 0x66
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
cmp al, 0x21
je 0x41e7f4
cmp al, 0x2c
je 0x41e7e5
cmp al, 0x3b
je 0x41e7d6
mov dword [edi], 0
mov dword [esi + 0x40], 0x6b
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [edi], 4
mov eax, 1
mov esp, ebp
pop ebp
ret
mov dword [edi], 2
mov eax, 1
mov esp, ebp
pop ebp
ret
mov dword [edi], 3
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41eb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x41eb1d
push 1
lea ecx, [ebp - 1]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x41eb31
mov edx, dword [edi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x41eb79
mov cl, byte [ebp - 1]
test cl, cl
jbe 0x41eb87
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x48]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x41eb5d
movzx ecx, byte [ebp - 1]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x41eb71
mov edx, dword [ecx + 0x38]
movzx ecx, byte [ebp - 1]
push edx
push ecx
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
movzx edx, byte [ebp - 1]
cmp eax, edx
je 0x41eb8d
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41ed00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x41ed1c
push 2
lea eax, [ebp - 4]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x41ed30
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [ebp - 4]
push 1
push edx
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 2
je 0x41ed42
mov dword [esi + 0x40], 0x66
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 4]
movzx ecx, ah
movzx edx, al
mov eax, dword [ebp + 8]
shl ecx, 8
or ecx, edx
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41ed60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41ed7d
push 1
lea ecx, [ebp - 1]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x41ed91
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x41edd9
mov cl, byte [ebp - 1]
test cl, cl
jbe 0x41ede7
lea eax, [esi + 0x44]
mov byte [eax], cl
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x41edbd
movzx ecx, byte [ebp - 1]
push ecx
push eax
push edi
call edx
add esp, 0xc
jmp 0x41edd1
mov edx, dword [ecx + 0x38]
movzx ecx, byte [ebp - 1]
push edx
push ecx
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
movzx edx, byte [ebp - 1]
cmp eax, edx
je 0x41edf8
mov dword [edi + 0x40], 0x66
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov byte [esi + 0x44], 0
mov dword [esi + 0x34], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ee10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 0x3c]
xor ebx, ebx
cmp eax, ebx
je 0x41ee33
push 1
lea ecx, [ebp - 1]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x41ee47
mov edx, dword [esi + 0x38]
push edx
push 1
lea eax, [ebp - 1]
push 1
push eax
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
jb 0x41ee5c
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jle 0x41ee65
mov dword [edi + 0x40], 0x66
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41f200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [esi]
push edi
test cl, cl
jne 0x41f2a3
mov ecx, dword [ebx + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41f223
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x41f234
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call sub.MSVCR90.dll_fread
add esp, 0x10
cmp eax, 1
je 0x41f245
mov dword [ebx + 0x40], 0x66
xor eax, eax
pop edi
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x41f257
mov dword [ebx + 0x40], 0x70
xor eax, eax
pop edi
pop ebp
ret
mov ecx, dword [ebx + 0x48]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x41f271
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x41f284
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call sub.MSVCR90.dll_fread
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x41f239
mov al, byte [edi]
mov edx, dword [ebp + 8]
dec cl
mov byte [edx], al
mov byte [edi], 2
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret
mov al, byte [esi + 1]
mov edi, dword [ebp + 8]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
mov byte [edi], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop edi
pop ebp
ret
Function at 0x41f8e0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41f903
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 4]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41f8fd
push 0x80020003
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret

Function at 0x41f9c0
Capabilities:
Execute command
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
push edi
push 0
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
test ebx, ebx
jbe 0x41fa49
mov dword [0x802d14], 1
call fcn.0041f960
call fcn.0041f8e0
mov edi, 0x5d4a24cb
lea esi, [ebp - 0x1c]
call fcn.0041fd70
push eax
call sub.MSVCR90.dll_system
add esp, 4
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jbe 0x41fa49
call fcn.0041f960
call fcn.0041f8e0
lea esi, [ebp - 0x1c]
call fcn.0041fd70
push eax
call sub.MSVCR90.dll_system
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4209b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
call esi
cmp dword [0x80333c], 0
je 0x420a11
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x800fd0]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x800fd4]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
fild qword [esp + 8]
fdiv qword [0x800e58]
fstp dword [esp + 8]
fld dword [0x6c6444]
fld dword [esp + 8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x420a7d
fstp st(0)
lea eax, [esp + 8]
push eax
mov dword [0x80333c], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp + 8]
push 0x800fd0
fstp qword [0x800e58]
call esi
mov ecx, dword [esp + 0x10]
sub ecx, dword [0x800fd0]
mov edx, dword [esp + 0x14]
sbb edx, dword [0x800fd4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
fdiv qword [0x800e58]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [0x803340]
fst dword [0x803344]
fst dword [0x803348]
fst dword [0x80334c]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420a90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x74496c]
xor eax, esp
mov dword [esp + 0x130], eax
cmp byte [0x803318], 1
push ebx
push esi
push edi
push 0
jne 0x420bf0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
je 0x420aec
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x420b03
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, eax
je 0x420bbf
test esi, esi
je 0x420bbf
push esi
call ebx
push str.xxxxxxxx____xxx
push 0x6c6398
push 0x128000
push 0x400000
push esi
call fcn.00420910
push str.x____xxxxx____xx
push 0x6c63bc
push 0x60000
push 0x900000
push esi
call fcn.00420910
push str.xxxxxxxxxxxxxxxxxx
push 0x6c63e4
push 0x10000
push fcn.00410000
push esi
call fcn.00420910
push str.xxx____xx____xx
push 0x6c6408
push 0x10000
push fcn.00410000
push esi
mov edi, eax
call fcn.00420910
add esp, 0x50
test edi, edi
jne 0x420bab
test eax, eax
je 0x420bb4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x420b09
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
call sub.MSVCR90.dll_exit
int3
Function at 0x421da0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x617817
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x74496c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
je 0x421df3
mov dword [ebp], 0x6c6434
mov dword [ebp + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 4], ebx
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
call fcn.00420770
lea esi, [ebp + 8]
push 0x20
mov ecx, edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.00423320
mov byte [edi + 0x30], al
cmp dword [edi + 0x28], ebx
jne 0x421e3e
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.004205d0
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00422fb0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x805b00]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x422fb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x6169eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x74496c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0060036a
push 4
mov dword [esp + 0x24], 0
call fcn.00583330
mov edi, eax
add esp, 4
test edi, edi
je 0x423032
call fcn.006007cf
mov dword [edi], eax
call fcn.006005fd
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00600407
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x423027
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0060042f
jmp 0x423034
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x444610
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6047c7
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x74496c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.0043b2d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.0043b2d0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.0043d460
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0043d460
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.0043dd90
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.0043dd90
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.00473390
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.00473410
movzx edx, al
test edx, edx
je 0x4446ee
lea ecx, [ebp - 0x1bc]
call fcn.0043c6e0
push eax
lea ecx, [ebp - 0x134]
call fcn.0043c6e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x4447cc
lea ecx, [ebp - 0x134]
call fcn.0043b460
test eax, eax
jg 0x444710
lea ecx, [ebp - 0x1bc]
call fcn.0043b460
test eax, eax
jle 0x4447a3
lea ecx, [ebp - 0x24c]
call fcn.0043b2d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.0043b2d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.00444840
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00444840
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.0043bd70
push eax
lea ecx, [ebp - 0x24c]
call fcn.0043bd70
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.0043b3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.0043b3e0
jmp 0x4447cc
lea ecx, [ebp - 0x1bc]
call fcn.0043bd70
push eax
lea ecx, [ebp - 0x134]
call fcn.0043bd70
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x4447e5
cmp dword [ebp + 0x10], 0
je 0x4447e5
mov ecx, dword [ebp + 0x10]
call fcn.00458a10
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.004733f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.0043b3e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.0043b3e0
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
Function at 0x444970
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60484c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x74496c]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.0043b2d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0043d460
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0043dd90
lea ecx, [ebp - 0x134]
call fcn.00473390
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.00473410
movzx ecx, al
test ecx, ecx
je 0x444a38
lea ecx, [ebp - 0x94]
call fcn.0043c6e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004733f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0043b3e0
mov al, byte [ebp - 0x255]
jmp 0x444c0b
lea ecx, [ebp - 0x94]
call fcn.0043b460
cmp eax, 0x104
jle 0x444b3e
lea ecx, [ebp - 0x1bc]
call fcn.0043b2d0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.004442a0
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.0043b2d0
mov byte [ebp - 4], 3
push 0x65eab4
lea ecx, [ebp - 0x24c]
call fcn.0043cf20
lea ecx, [ebp - 0x1bc]
call fcn.0043d140
push eax
lea ecx, [ebp - 0x24c]
call fcn.0043cf20
lea ecx, [ebp - 0x24c]
call fcn.0043bd70
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x444adf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x444adf
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.0043b3e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.0043b3e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004733f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0043b3e0
mov al, byte [ebp - 0x256]
jmp 0x444c0b
lea ecx, [ebp - 0x94]
call fcn.0043bd70
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x444bb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x444b9e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00458ab0
lea ecx, [ebp - 0x94]
call fcn.0043d140
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x444bb1
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004733f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0043b3e0
mov al, byte [ebp - 0x257]
jmp 0x444c0b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret
Function at 0x445bf0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x604a01
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x74496c]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.0043b460
test eax, eax
jne 0x445c5b
cmp dword [ebp + 0x14], 0
je 0x445c54
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x445dc4
lea ecx, [ebp - 0x94]
call fcn.0043b2d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0043d460
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.0043dd90
lea ecx, [ebp - 0x94]
call fcn.0043b460
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.00473390
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x445d0c
lea ecx, [ebp - 0x94]
call fcn.0043c3c0
movzx ecx, al
test ecx, ecx
jne 0x445cdb
lea ecx, [ebp - 0x134]
call fcn.00473410
movzx edx, al
test edx, edx
je 0x445d0c
lea ecx, [ebp - 0x94]
call fcn.0043c6e0
push eax
call fcn.00447a60
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x445d07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x445d8c
cmp dword [ebp - 0x138], 0
jle 0x445d62
lea ecx, [ebp - 0x1c4]
call fcn.0043b2d0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00444840
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.0043bd90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.0043b3e0
jmp 0x445d79
lea ecx, [ebp - 0x94]
call fcn.0043bd90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x445d8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.004733f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0043b3e0
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.005ff0f4
mov esp, ebp
pop ebp
ret