joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
jmp 0x4325b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4325b0
sub eax, edx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00472610
lea ecx, [esp + 0x10]
call fcn.004728e0
lea ecx, [esp + 0x10]
call fcn.00472720
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472460
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x64
jle 0x4325f9
mov eax, edi
jmp 0x43260d
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push str._u._03u
push edx
call fcn.004af01a
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432628
sub eax, edx
add eax, ebx
cmp eax, dword [esp + 0x74]
jae 0x43268c
cmp esi, 0x3e8
je 0x43268c
lea eax, [esp + 0x34]
mov edx, eax
mov ecx, ebp
sub ecx, edx
lea edx, [ecx + ebx]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432650
call fcn.00443050
test ebp, ebp
je 0x432675
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x432675
inc esi
jmp 0x4325f0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004af00b
add esp, 0x5c
ret 8
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004af00b
add esp, 0x5c
ret 8

Function at 0x4326b0
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004af840
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.00443050
test eax, eax
je 0x43273f
test esi, esi
je 0x4326fb
cmp word [esi], 0
jne 0x432705
test edi, edi
je 0x43273f
cmp word [edi], 0
je 0x43273f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.00455cc0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.00455cc0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x432747
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0x1004
ret 0x10
Function at 0x432c70
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.00443050
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x432c98
test esi, esi
je 0x432c98
cmp word [esi], 0
je 0x432c98
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x432ca5
test edi, edi
je 0x432cd8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x432cc3
cmp byte [esp + 0x14], 0
je 0x432cbc
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00432540
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x432cd8
cmp eax, 3
mov eax, 1
jne 0x432cdd
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x432cf0
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x432e1d
cmp byte [ebp], 0
je 0x432e1d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x432da0
cmp byte [edi], 0x5c
jne 0x432d82
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004b0a90
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.00443050
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x432d77
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.00432540
jmp 0x432d82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x562890], 0
je 0x432d9a
push edi
mov ecx, 0x562790
call fcn.004783a0
mov edi, eax
jmp 0x432d9b
inc edi
cmp byte [edi], 0
jne 0x432d30
cmp byte [esp + 0x420], 0
pop esi
jne 0x432dff
push ebp
call fcn.00455e70
movsx eax, byte [eax]
push eax
call fcn.00455760
test al, al
jne 0x432dff
call fcn.00443050
push 0
push ebp
call ebx
test eax, eax
je 0x432df4
push 0
push 0
push ebp
call fcn.00432540
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004af00b
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004af00b
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004af00b
add esp, 0x408
ret 8
Function at 0x432e40
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x432f74
cmp word [ebp], 0
je 0x432f74
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x432eec
cmp word [edi + ebp], 0x5c
jne 0x432ee2
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004b0c0c
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.00443050
test eax, eax
je 0x432edd
cmp word [esp + 0x14], 0
je 0x432edd
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x432ed7
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00432540
jmp 0x432ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x432e80
cmp byte [esp + 0x820], 0
pop esi
jne 0x432f56
push ebp
call fcn.004556e0
movzx ecx, word [eax]
push ecx
call fcn.00455760
test al, al
jne 0x432f56
call fcn.00443050
test eax, eax
je 0x432f51
cmp word [ebp], 0
je 0x432f51
push 0
push ebp
call ebx
test eax, eax
je 0x432f4b
push 0
push ebp
push 0
call fcn.00432540
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004af00b
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004af00b
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004af00b
add esp, 0x808
ret 8
Function at 0x432fd0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.00443050
test eax, eax
je 0x43316e
test esi, esi
je 0x433032
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x433037
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x433045
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x43304a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43305c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x433061
mov byte [esp + 0x13], 0
call fcn.00443050
test eax, eax
je 0x433081
test edi, edi
je 0x433081
cmp word [edi], 0
je 0x433081
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x43308c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x433189
test al, 1
je 0x433189
push 0
push edi
push ebp
mov bl, 1
call fcn.00432540
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00455cc0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43316e
cmp byte [esp + 0x12], 0
je 0x4330f6
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.00472390
cmp byte [esp + 0x11], 0
je 0x43310b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00472390
cmp byte [esp + 0x13], 0
je 0x433120
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.00472390
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x43316e
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00432540
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x4330a8

Function at 0x433290
Capabilities:
Set file attributes

Disassembly:
call fcn.00443050
test eax, eax
je 0x4332b9
mov eax, dword [esp + 8]
test eax, eax
je 0x4332b9
cmp word [eax], 0
je 0x4332b9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x4332d3
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x4332e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x94]
push ebp
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433304
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.00472610
lea ecx, [esp + 0x10]
call fcn.004728e0
lea ecx, [esp + 0x10]
call fcn.00472720
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472460
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
cmp esi, 0x64
jbe 0x43334f
mov eax, edi
jmp 0x433363
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push 0x4c7054
push edx
mov edx, 0x32
call fcn.004a5f50
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433383
sub eax, edx
sar eax, 1
add eax, ebp
cmp eax, dword [esp + 0xa4]
jae 0x4333f1
cmp esi, 0x3e8
je 0x4333f1
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4333b4
call fcn.00443050
test eax, eax
je 0x4333ed
test ebx, ebx
je 0x4333ed
cmp word [ebx], 0
je 0x4333ed
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4333ed
inc esi
jmp 0x433346
mov eax, ebx
jmp 0x4333f3
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0x8c
ret 8
Function at 0x433410
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c26a6
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.004681f0
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004af0e6
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x433489
mov ecx, 0x513904
call fcn.00429a10
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00431310
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x526d84], esi
je 0x4334de
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.0048b4b0
mov edx, dword [0x526d84]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.004319b0
jmp 0x4334f4
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x43350b
cmp dword [esp + 0xc60], eax
je 0x43351e
cmp dword [esp + 0xc60], 0
jl 0x433523
jg 0x43351e
cmp eax, 0x10000
jbe 0x433523
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00431cc0
mov edi, eax
test edi, edi
je 0x4335e8
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x4335a9
cmp dword [0x526d84], eax
je 0x4335a4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004afe90
push edx
push eax
call fcn.0046eca0
push eax
push 0x51e
call fcn.00466160
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.004a5f50
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.0048b4d0
call fcn.0048bb70
call fcn.00470370
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.004213b0
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x4335d2
cmp dword [esp + 0xc60], eax
je 0x4334f0
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x4334f0
cmp dword [0x526d84], 0
je 0x43360d
lea eax, [esp + 0x44]
push eax
call fcn.0048b4d0
lea ecx, [esp + 0x844]
push ecx
call fcn.0048b460
call fcn.0048bb70
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43362a
push eax
call fcn.004af1b0
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00468220
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004af00b
add esp, 0xc40
ret 0x10
Function at 0x433670
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x4336c8
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x4337a0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4c26f6
mov eax, dword fs:[0]
push eax
mov eax, 0x18d8
call fcn.004af840
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x18d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x18ec]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18fc]
mov edi, dword [esp + 0x1900]
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.00430fc0
xor ebx, ebx
mov dword [esp + 0x18f4], ebx
push 1
push ebx
push edi
push esi
lea ecx, [esp + 0x40]
call fcn.00431400
test al, al
je 0x4338e5
lea ecx, [esp + 0x30]
call fcn.00431310
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call fcn.004af0e6
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebx
jne 0x43384e
mov ecx, 0x513904
call fcn.00429a10
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x18f4], 1
push edi
push ebx
push esi
call fcn.004af870
add esp, 0xc
xor edi, edi
test ebp, ebp
jl 0x4338a4
jg 0x433880
cmp dword [esp + 0x1c], edi
jbe 0x4338a4
jmp 0x433880
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.00431a90
add ebx, 0x10000
adc edi, 0
cmp edi, ebp
jl 0x433880
jg 0x4338a4
cmp ebx, dword [esp + 0x1c]
jb 0x433880
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.004319b0
lea ecx, [esp + 0x30]
call fcn.004312b0
lea ecx, [esp + 0x30]
call fcn.00431040
mov byte [esp + 0x18f4], 0
test esi, esi
je 0x4338e5
push esi
call fcn.004af1b0
add esp, 4
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push 0x432
lea ecx, [esp + 0xc54]
push ecx
push edx
lea edi, [esp + 0x14c0]
call fcn.004336d0
test al, al
je 0x433949
call fcn.00443050
test eax, eax
je 0x433934
cmp word [esp + 0xc50], 0
je 0x433934
lea eax, [esp + 0xc50]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x433979
lea ecx, [esp + 0x14b4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x433979
call fcn.00443050
test eax, eax
je 0x433969
mov eax, dword [esp + 0x18]
test eax, eax
je 0x433969
cmp word [eax], 0
je 0x433969
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x433972
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
mov dword [esp + 0x18f4], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.004313d0
mov al, bl
mov ecx, dword [esp + 0x18ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18d4]
xor ecx, esp
call fcn.004af00b
add esp, 0x18e4
ret 8
Function at 0x4339c0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc9c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0xc98], eax
push ebx
mov ebx, dword [esp + 0xca4]
push esi
mov esi, dword [esp + 0xcac]
push edi
push 0x432
lea eax, [esp + 0x444]
push eax
push esi
lea edi, [esp + 0x18]
call fcn.004336d0
test al, al
je 0x433a2b
call fcn.00443050
test eax, eax
je 0x433a24
cmp word [esp + 0x440], 0
je 0x433a24
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x433a4e
lea edx, [esp + 0xc]
push edx
jmp 0x433a48
call fcn.00443050
test eax, eax
je 0x433a47
test esi, esi
je 0x433a47
cmp word [esi], 0
je 0x433a47
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x433a4e
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xca4]
pop edi
test eax, eax
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.004af00b
add esp, 0xc9c
ret 8
Function at 0x433a70
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c2746
mov eax, dword fs:[0]
push eax
mov eax, 0x4178
call fcn.004af840
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x4174], eax
push ebp
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x4188]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4198]
push esi
call fcn.00455bc0
test al, al
je 0x433d09
push esi
call fcn.004320d0
test al, al
je 0x433d09
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x4c7084
push ecx
call fcn.004af01a
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0x341
call fcn.00466160
push eax
lea eax, [esp + 0x3d8c]
push eax
mov edx, 0x200
call fcn.004a5f50
add esp, 0xc
lea ecx, [esp + 0x3d84]
push ecx
call fcn.0048b4d0
lea ecx, [esp + 0x10]
call fcn.0046fbd0
mov dword [esp + 0x4190], 0
lea edx, [esp + 0x3984]
push edx
lea ecx, [esp + 0x14]
call fcn.0046fc70
push 2
push 0
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1568]
call fcn.004688f0
mov byte [esp + 0x4190], 1
lea ecx, [esp + 0xccc]
call fcn.00472610
lea ecx, [esp + 0xcf0]
call fcn.00472610
lea ecx, [esp + 0xd14]
call fcn.00472610
lea ecx, [esp + 0xb8]
push ecx
lea ecx, [esp + 0x155c]
call fcn.00469440
test eax, eax
jne 0x433ce1
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x433ce1
cmp byte [esp + 0xb9], 0x3a
jne 0x433ce1
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x433bf7
movsx edx, al
movzx eax, cx
cmp eax, edx
jne 0x433ce1
cmp word [esp + 0x4ba], 0x3a
jne 0x433ce1
call fcn.00443050
test eax, eax
je 0x433c19
cmp word [esp + 0x4b8], 0
je 0x433c19
push 0
lea ecx, [esp + 0x4bc]
push ecx
call edi
jmp 0x433c25
push 0
lea edx, [esp + 0xbc]
push edx
call ebp
cmp byte [esp + 0xcc8], 0
je 0x433c63
call fcn.00443050
test eax, eax
je 0x433c53
cmp word [esp + 0x4b8], 0
je 0x433c53
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x433cc5
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x433cc5
call fcn.00443050
test eax, eax
je 0x433c87
cmp word [esp + 0x4b8], 0
je 0x433c87
lea edx, [esp + 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x433c95
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x433cc5
lea ecx, [esp + 0x4b8]
push ecx
push 0x202
call fcn.00466160
push eax
push 0
call fcn.00498e30
add esp, 0xc
mov ecx, 0x513904
call fcn.00429940
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00469440
test eax, eax
je 0x433bb0
mov byte [esp + 0x4190], 0
lea ecx, [esp + 0x1558]
call fcn.00468ba0
mov dword [esp + 0x4190], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401a70
mov ecx, dword [esp + 0x4188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4174]
xor ecx, esp
call fcn.004af00b
add esp, 0x4184
ret 4
Function at 0x434dd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push 0x4000
call fcn.004af0e6
add esp, 4
mov dword [esp], eax
test eax, eax
jne 0x434df2
mov eax, 4
add esp, 0xc
ret 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], esi
mov eax, edi
and eax, ebp
cmp eax, 0xffffffff
je 0x434e21
cmp esi, ebp
ja 0x434ee2
jb 0x434e21
cmp ebx, edi
jae 0x434ee2
call fcn.0044b180
cmp byte [0x51390c], 0
je 0x434e38
cmp byte [0x527e58], 0
jne 0x434ea6
mov ecx, edi
and ecx, ebp
cmp ecx, 0xffffffff
je 0x434e5d
mov ecx, edi
sub ecx, ebx
mov eax, ebp
sbb eax, esi
test eax, eax
ja 0x434e5d
jb 0x434e57
cmp ecx, 0x4000
jae 0x434e5d
mov eax, edi
sub eax, ebx
jmp 0x434e62
mov eax, 0x4000
mov edx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x18]
push 1
push eax
call fcn.004b21ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434eb5
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push ecx
push esi
push 1
push edx
call fcn.004b1ec8
add esp, 0x10
cmp eax, esi
jne 0x434efb
add ebx, esi
adc dword [esp + 0x18], 0
mov esi, dword [esp + 0x18]
jmp 0x434e06
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x20]
push eax
call fcn.004b1d32
add esp, 4
test eax, eax
je 0x434ee2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004af1b0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0xc
ret 0x10
mov edx, dword [esp + 0x10]
push edx
call fcn.004af1b0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x10]
push eax
call fcn.004af1b0
mov eax, dword [0x514dd8]
add esp, 4
test eax, eax
je 0x434f21
push eax
push 0
push eax
push 0
mov ecx, 0x513904
call fcn.00429fd0
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xc
ret 0x10