joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4203dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040dd8b
and dword [ebp - 0x14], 0
cmp dword [0x4378b0], 0
mov dword [ebp - 0x18], eax
jne 0x41607e
push 0x403f10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416126
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f04
push ebx
call edi
test eax, eax
je 0x416126
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ef4
push ebx
mov dword [0x4378b0], eax
call edi
push eax
call esi
push 0x403ee0
push ebx
mov dword [0x4378b4], eax
call edi
push eax
call esi
push 0x403ec4
push ebx
mov dword [0x4378b8], eax
call edi
push eax
call esi
mov dword [0x4378c0], eax
test eax, eax
je 0x41607e
push 0x403eac
push ebx
call edi
push eax
call esi
mov dword [0x4378bc], eax
mov eax, dword [0x4378bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4160d7
cmp dword [0x4378c0], ecx
je 0x4160d7
push eax
call esi
push dword [0x4378c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4160d7
test ebx, ebx
je 0x4160d7
call edi
test eax, eax
je 0x4160ce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4160ce
test byte [ebp - 8], 1
jne 0x4160d7
or dword [ebp + 0x10], 0x200000
jmp 0x41610a
mov eax, dword [0x4378b4]
cmp eax, dword [ebp - 0x18]
je 0x41610a
push eax
call esi
test eax, eax
je 0x41610a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41610a
mov eax, dword [0x4378b8]
cmp eax, dword [ebp - 0x18]
je 0x41610a
push eax
call esi
test eax, eax
je 0x41610a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4378b0]
call esi
test eax, eax
je 0x416126
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416128
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b0ae
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x71cb527f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
mov ecx, 0x67a76a9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10072260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x100722fb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100722b2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100722b2
cmp esi, ebx
jge 0x100722b2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x100722f5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x100722f5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007230d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x10072558
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072572
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100591dc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076450
leave
ret 4

Function at 0x10072740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072776
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100727d5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100591dc
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100591dc
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100591dc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076450
leave
ret 0x10
Function at 0x100727f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007281c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1007284d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1007284b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100591dc
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1007284d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076450
leave
ret 8
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x408939
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
sub esi, esi
call fcn.0040895b
add esi, esi
xor dword [edx], eax
or esi, esi
inc esi
inc edx
add esi, ecx
add ecx, 0xb519f12
cmp edx, ebx
jne fcn.00408939
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2cec4a2b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xff41619
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4079c0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x407a8d
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x407a77
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.0049d980
add esp, 0xc
mov dword [ebp - 0x314], 0x73646c
lea eax, [ebp - 0x314]
push edi
push 0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x407a8d
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.0049d980
add esp, 0xc
mov dword [ebp - 0x318], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.00407b60
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.004b8961
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x407aed
cmp eax, 0x207
ja 0x407aed
jne 0x407af4
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407b00
push 0
lea eax, [ebp - 0x318]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00483518
mov esp, ebp
pop ebp
ret
Function at 0x40a280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a2d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a2d9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40a2ca
cmp esi, edx
jae 0x40a2d9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40a2b8
cmp esi, edx
jae 0x40a2d9
cmp word [esi], 0
je 0x40a2d9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40bdc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511608
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x56e6c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x530cc4
push 1
push 0
push 0x530cb4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x40bf4b
xorps xmm0, xmm0
lea edx, [ebp - 0x28]
movlpd qword [ebp - 0x28], xmm0
push 0
mov dword [ebp - 0x28], 8
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x18]
test eax, eax
jne 0x40be47
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x28]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea eax, [ebp - 0x18]
push eax
call fcn.0040b6d0
add esp, 4
push dword [ebp - 0x18]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40be75
mov eax, dword [ebp - 0x10]
push 0
push dword [ebp - 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [0x56c06c], 0
je 0x40befb
push str.ntdll.dll
mov dword [ebp - 0x1c], 0
xor edi, edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40bef1
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bed0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
call eax
movzx eax, word [ebp - 0x14]
mov edi, 1
mov dword [ebp - 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x40bef1
mov eax, dword [0x571b24]
mov ecx, 1
cmp dword [ebp - 0x1c], 6
cmovae eax, ecx
mov dword [0x571b24], eax
mov dword [0x56c06c], 0
cmp dword [0x571b24], 0
je 0x40bf08
push 0xf
jmp 0x40bf17
call fcn.0040bd10
test eax, eax
je 0x40bf15
push 0xf
jmp 0x40bf17
push 7
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40bf4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40cb80
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00483980
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x40cbb0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.0049d980
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004b9d5f
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00483518
mov esp, ebp
pop ebp
ret
Function at 0x40cc40
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40ce53
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ce53
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cc73
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x40ce53
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.0049d980
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0049d980
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x526914
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ccf4
test al, 1
je 0x40ccf4
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x40ce39
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40ce2d
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x40cda8
cmp word [ebp - 0x638], 0x2e
jne 0x40cd67
mov ax, word [ebp - 0x636]
test ax, ax
je 0x40ce12
cmp ax, 0x2e
jne 0x40cd67
cmp word [ebp - 0x634], 0
je 0x40ce12
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0040cc40
add esp, 4
jmp 0x40ce10
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cdff
test al, 1
je 0x40cdff
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40cd30
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00483518
mov esp, ebp
pop ebp
ret
Function at 0x40ce70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40cec8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cec8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40cea8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40cec8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40cec3
test al, 0x10
je 0x40cec3
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40cec8
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x40d5b0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40d5df
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.00435e00
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d5d7
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40d605
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40d5c2
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40d620
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511716
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40d65c
xor eax, eax
jmp 0x40d862
cmp word [ebx], 0
je 0x40d655
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d667
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x40d655
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x526994
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d6c2
test al, 1
je 0x40d6c2
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 0x5c
mov dword [ebp - 0x428], 0
mov word [ebp - 0x42c], ax
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x884]
call fcn.0040ced0
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x40d812
cmp dword [ebp - 0x424], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0x40d771
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x40d771
cmp word [ebp - 0x858], 0x2e
jne 0x40d771
mov ax, word [ebp - 0x856]
test ax, ax
je 0x40d74c
cmp ax, 0x2e
jne 0x40d771
cmp word [ebp - 0x854], 0
jne 0x40d771
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x40d87e
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
jmp 0x40d804
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x884]
call fcn.0040d010
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
je 0x40d7ac
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x40d7ac
mov esi, dword [ebp - 0x888]
push esi
call fcn.0040d620
jmp 0x40d7b8
mov esi, dword [ebp - 0x888]
push esi
call fcn.0040d5b0
mov eax, dword [ebp - 0x428]
add esp, 4
test eax, eax
jne 0x40d7c9
xor edi, edi
jmp 0x40d7e8
cmp dword [ebp - 0x424], 0
jne 0x40d7d6
xor edi, edi
jmp 0x40d7e8
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d804
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x40d709
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x424], 0
test eax, eax
je 0x40d838
cmp eax, 0xffffffff
je 0x40d838
push eax
call esi
mov dword [ebp - 0x428], 0
push ebx
call fcn.0040cb80
mov eax, dword [ebp - 0x428]
add esp, 4
mov dword [ebp - 0x424], 0
test eax, eax
je 0x40d85d
cmp eax, 0xffffffff
je 0x40d85d
push eax
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x424], 0
jmp 0x40d838