joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431090]
jne 0x401abf
repz ret
jmp fcn.00403038

Function at 0x40b293
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040431b
and dword [ebp - 4], 0
cmp dword [0x435640], 0
mov ebx, eax
jne 0x40b344
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b3f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b3f5
push eax
call fcn.004042a9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435640], eax
call esi
push eax
call fcn.004042a9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435644], eax
call esi
push eax
call fcn.004042a9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435648], eax
call esi
push eax
call fcn.004042a9
pop ecx
mov dword [0x435650], eax
test eax, eax
je 0x40b344
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004042a9
pop ecx
mov dword [0x43564c], eax
mov eax, dword [0x43564c]
cmp eax, ebx
je 0x40b39c
cmp dword [0x435650], ebx
je 0x40b39c
push eax
call fcn.00404324
push dword [0x435650]
mov esi, eax
call fcn.00404324
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b39c
test edi, edi
je 0x40b39c
call esi
test eax, eax
je 0x40b393
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b393
test byte [ebp - 0xc], 1
jne 0x40b39c
or dword [ebp + 0x10], 0x200000
jmp 0x40b3d5
mov eax, dword [0x435644]
cmp eax, ebx
je 0x40b3d5
push eax
call fcn.00404324
pop ecx
test eax, eax
je 0x40b3d5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b3d5
mov eax, dword [0x435648]
cmp eax, ebx
je 0x40b3d5
push eax
call fcn.00404324
pop ecx
test eax, eax
je 0x40b3d5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435640]
call fcn.00404324
pop ecx
test eax, eax
je 0x40b3f5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b3f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40da19
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x431090]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 8], esi
jle 0x40da86
lea eax, [ebp - 0x808]
push eax
mov dword [ebp - 0x808], esi
call fcn.0040da0a
mov al, byte [ebp - 0x808]
xor byte [ebx + edi], al
cmp dword [ebp + 8], 0xf
pop ecx
jne 0x40da80
push esi
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push esi
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
inc edi
cmp edi, dword [ebp + 8]
jl 0x40da37
cmp dword [ebp + 8], 0x2d
pop edi
pop esi
jne 0x40da9f
or dword [0x271d7b4], 0xffffffff
mov dword [0x271d7b0], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ab5
leave
ret
Function at 0x411539
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42c668
call fcn.00411d81
push 1
call fcn.00411884
pop ecx
test al, al
jne 0x411558
push 7
call fcn.00411b88
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041184f
mov byte [ebp - 0x24], al
mov eax, dword [0x42ed34]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x411551
test eax, eax
jne 0x4115c2
mov dword [0x42ed34], ecx
push 0x4252c0
push 0x4252a4
call fcn.0041a3ca
pop ecx
pop ecx
test eax, eax
je 0x4115a5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4116a9
push 0x4252a0
push 0x425298
call fcn.0041a36e
pop ecx
pop ecx
mov dword [0x42ed34], 2
jmp 0x4115c7
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004119e1
pop ecx
call fcn.00411b7c
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4115f7
push esi
call fcn.00411954
pop ecx
test al, al
je 0x4115f7
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00411d7b
call esi
call fcn.00411b82
mov esi, eax
cmp dword [esi], edi
je 0x411615
push esi
call fcn.00411954
pop ecx
test al, al
je 0x411615
push dword [esi]
call fcn.0041a68c
pop ecx
push edi
call fcn.00414a0f
pop ecx
call fcn.00411c9d
movzx eax, ax
push eax
call fcn.0041a31b
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call fcn.00414aab
pop ecx
call fcn.0041a59b
test al, al
jne 0x41164e
push esi
call fcn.0041a6c4
test bl, bl
jne 0x411657
call fcn.0041a667
push edi
push 1
call fcn.004119fe
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4116a9
call fcn.00411dc7
ret
call fcn.0059f000
jmp 0x411539
Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0

Function at 0x50d684
Capabilities:
Encode data using xor

Disassembly:
fdiv qword gs:[ebx]
sti
xor edi, ebx
rcl byte [ebx], 0xe5
aaa
daa
aas
jp 0x50d680
cmc
salc
or al, 0x18
mov dl, 0x15
Function at 0x40bff6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x423722
call fcn.00422000
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
call fcn.0040237f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c042
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40c09f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42376d
call fcn.00422000
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0040e696
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0040c0ea
push dword [esi + 0x24]
call fcn.00401f15
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00419d02
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040c619
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40f910
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x42bb84
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret

Function at 0x41095b
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x423f4c
call fcn.00422000
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x425928
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.0040237f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0040237f
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.0040237f
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.0040237f
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.0040237f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4258f4
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410967
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x423f4c
call fcn.00422000
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x425928
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.0040237f
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.0040237f
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], bl
call fcn.0040237f
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.0040237f
lea eax, [esi + 0x80]
mov byte [esi + 0x7c], 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.0040237f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4258f4
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x410e22
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x424042
call fcn.00422000
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x425928
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.0040237f
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040237f
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040237f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x425988
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x410e84
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x424075
call fcn.00422000
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.00419d02
push dword [esi + 0x24]
call fcn.00401f15
push dword [esi + 0x18]
call fcn.00401f15
push dword [esi + 0xc]
call fcn.00401f15
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x425958
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x413a81
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x42451c
call fcn.00422000
sub esp, 0x44
push ebx
push esi
push edi
mov esi, ecx
push 0
call fcn.00412739
push 1
mov ecx, esi
call fcn.0041308d
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.0040f529
mov eax, dword [eax]
lea edi, [esi + 4]
push eax
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push dword [ebp - 0x20]
call fcn.00401f15
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
pop ecx
push 2
push dword [edi]
call ebx
push 1
push 1
push 0xf4
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1bc
push dword [edi]
call ebx
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1be
push dword [edi]
call ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x50]
call fcn.00413c10
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.00413c10
lea eax, [esi + 0x1e4]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1ac], ebx
lea ebx, [esi + 0x1b4]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
setne byte [ebp - 0xd]
call fcn.00413c41
add ebx, 0x18
lea ecx, [ebp - 0x38]
push ebx
call fcn.00413c41
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp dword [ebp - 0x40], ebx
je 0x413b94
cmp dword [ebp - 0x4c], ebx
mov byte [esi + 0x203], 1
jne 0x413b8a
push 0x42b598
lea ecx, [ebp - 0x50]
call fcn.0040243f
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x413bbf
cmp byte [ebp - 0xd], 0
jne 0x413bd5
cmp dword [ebp - 0x28], ebx
mov byte [esi + 0x203], 1
je 0x413bee
cmp dword [ebp - 0x34], ebx
jne 0x413bb8
push 0x42b598
lea ecx, [ebp - 0x38]
call fcn.0040243f
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
mov eax, esi
neg eax
sbb eax, eax
and eax, edi
push dword [eax]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0xd], 0
je 0x413bee
cmp byte [esi + 0x136], 0
jne 0x413bee
mov ecx, esi
mov byte [esi + 0x135], 1
call fcn.00413fe6
jmp 0x413bf7
push ebx
push dword [edi]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.0040837b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x414572
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc

Function at 0x420620
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x4305f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640297
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x134]
call fcn.00427280
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00427280
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x134]
call fcn.00429410
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00429410
push 0x5c
push 0x2f
lea ecx, [ebp - 0x134]
call fcn.00429d40
push 0x5c
push 0x2f
lea ecx, [ebp - 0x1bc]
call fcn.00429d40
mov byte [ebp - 0x1bd], 0
lea ecx, [ebp - 0xac]
call fcn.0045cd60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.0045cde0
movzx edx, al
test edx, edx
je 0x4306ce
lea ecx, [ebp - 0x1bc]
call fcn.00428690
push eax
lea ecx, [ebp - 0x134]
call fcn.00428690
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
jmp 0x4307ac
lea ecx, [ebp - 0x134]
call fcn.00427410
test eax, eax
jg 0x4306f0
lea ecx, [ebp - 0x1bc]
call fcn.00427410
test eax, eax
jle 0x430783
lea ecx, [ebp - 0x24c]
call fcn.00427280
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00427280
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x134]
push edx
call fcn.00430820
add esp, 8
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00430820
add esp, 8
lea ecx, [ebp - 0x2d4]
call fcn.00427d20
push eax
lea ecx, [ebp - 0x24c]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dl
mov byte [ebp - 0x1bd], dl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d4]
call fcn.00427390
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00427390
jmp 0x4307ac
lea ecx, [ebp - 0x1bc]
call fcn.00427d20
push eax
lea ecx, [ebp - 0x134]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
mov byte [ebp - 0x1bd], al
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
jne 0x4307c5
cmp dword [ebp + 0x10], 0
je 0x4307c5
mov ecx, dword [ebp + 0x10]
call fcn.00444900
mov dl, byte [ebp - 0x1bd]
mov byte [ebp - 0x2d5], dl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0045cdc0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bc]
call fcn.00427390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.00427390
mov al, byte [ebp - 0x2d5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x430950
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64031c
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x94]
call fcn.00427280
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00429410
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00429d40
lea ecx, [ebp - 0x134]
call fcn.0045cd60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x134]
call fcn.0045cde0
movzx ecx, al
test ecx, ecx
je 0x430a18
lea ecx, [ebp - 0x94]
call fcn.00428690
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne dl
mov byte [ebp - 0x255], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045cdc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00427390
mov al, byte [ebp - 0x255]
jmp 0x430beb
lea ecx, [ebp - 0x94]
call fcn.00427410
cmp eax, 0x104
jle 0x430b1e
lea ecx, [ebp - 0x1bc]
call fcn.00427280
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.00430280
add esp, 8
lea ecx, [ebp - 0x24c]
call fcn.00427280
mov byte [ebp - 4], 3
push 0x68e66c
lea ecx, [ebp - 0x24c]
call fcn.00428ed0
lea ecx, [ebp - 0x1bc]
call fcn.004290f0
push eax
lea ecx, [ebp - 0x24c]
call fcn.00428ed0
lea ecx, [ebp - 0x24c]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x430abf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x430abf
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
setne dl
mov byte [ebp - 0x256], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.00427390
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.00427390
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045cdc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00427390
mov al, byte [ebp - 0x256]
jmp 0x430beb
lea ecx, [ebp - 0x94]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x430b91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp + 0xc], 0
je 0x430b7e
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004449a0
lea ecx, [ebp - 0x94]
call fcn.004290f0
push eax
push str.failedToDeleteFilepath
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x254], 2
jne 0x430b91
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
setne cl
mov byte [ebp - 0x257], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045cdc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00427390
mov al, byte [ebp - 0x257]
jmp 0x430beb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x431bc0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640421
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 0x98], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
mov ecx, dword [ebp + 8]
call fcn.00427410
test eax, eax
jne 0x431c2b
cmp dword [ebp + 0x14], 0
je 0x431c24
push str.GetAttributes:_filename_is_empty
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x431d94
lea ecx, [ebp - 0x94]
call fcn.00427280
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.00429410
push 0x5c
push 0x2f
lea ecx, [ebp - 0x94]
call fcn.00429d40
lea ecx, [ebp - 0x94]
call fcn.00427410
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0x134]
call fcn.0045cd60
mov byte [ebp - 4], 1
cmp dword [ebp - 0x138], 0x104
jge 0x431cdc
lea ecx, [ebp - 0x94]
call fcn.00428370
movzx ecx, al
test ecx, ecx
jne 0x431cab
lea ecx, [ebp - 0x134]
call fcn.0045cde0
movzx edx, al
test edx, edx
je 0x431cdc
lea ecx, [ebp - 0x94]
call fcn.00428690
push eax
call fcn.00433a30
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x431cd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x431d5c
cmp dword [ebp - 0x138], 0
jle 0x431d32
lea ecx, [ebp - 0x1c4]
call fcn.00427280
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x94]
push eax
call fcn.00430820
add esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00427d40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00427390
jmp 0x431d49
lea ecx, [ebp - 0x94]
call fcn.00427d40
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x431d5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [edx], 0xffffffff
setne al
mov byte [ebp - 0x1c5], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.0045cdc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00427390
mov al, byte [ebp - 0x1c5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x98]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret
Function at 0x432150
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6404cc
mov eax, dword fs:[0]
push eax
sub esp, 0x1e4
mov eax, dword [0x79b5e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x13c]
call fcn.00427280
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00429410
push 0x5c
push 0x2f
lea ecx, [ebp - 0x13c]
call fcn.00429d40
lea ecx, [ebp - 0xac]
call fcn.0045cd60
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xac]
call fcn.0045cde0
movzx ecx, al
test ecx, ecx
je 0x4321f4
push 0
lea ecx, [ebp - 0x13c]
call fcn.00428690
push eax
call fcn.004339f0
add esp, 8
mov dword [ebp - 0xb0], eax
jmp 0x43226d
lea ecx, [ebp - 0x13c]
call fcn.00427410
test eax, eax
jle 0x432253
lea ecx, [ebp - 0x1c4]
call fcn.00427280
mov byte [ebp - 4], 2
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.00430820
add esp, 8
push 0
lea ecx, [ebp - 0x1c4]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00427390
jmp 0x43226d
push 0
lea ecx, [ebp - 0x13c]
call fcn.00427d20
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x4322c3
cmp dword [ebp + 0xc], 0
je 0x4322c3
lea ecx, [ebp - 0x1ec]
call fcn.0042ca40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ec]
call fcn.0042fcf0
lea ecx, [ebp - 0x1ec]
call fcn.00429f80
push eax
push str.errorMsg
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
call fcn.0042ce10
cmp dword [ebp - 0xb0], 0
setne cl
mov byte [ebp - 0x1ed], cl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac]
call fcn.0045cdc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00427390
mov al, byte [ebp - 0x1ed]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0061b9b8
mov esp, ebp
pop ebp
ret