joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e140
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00459470
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x42e19b
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi + 4]
test esi, esi
je 0x42e26c
mov ecx, dword [edi + 8]
test ecx, ecx
jle 0x42e26c
mov eax, ecx
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [ebp - 0x1010], eax
and ecx, 0x80000fff
jns 0x42e1d5
dec ecx
or ecx, 0xfffff000
inc ecx
xor edi, edi
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], 0
test eax, eax
jle 0x42e23a
nop dword [eax + eax]
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004924d0
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42e26c
inc edi
add esi, 0x1000
cmp edi, dword [ebp - 0x1010]
jl 0x42e1f0
mov ecx, dword [ebp - 0x100c]
test ecx, ecx
jle 0x42e26c
push ecx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004924d0
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0
push eax
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045945a
mov esp, ebp
pop ebp
ret 4
Function at 0x430740
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00459470
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x430770
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.00492a50
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004c51fe
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0045945a
mov esp, ebp
pop ebp
ret
Function at 0x430800
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x430a13
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430a13
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430833
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x430a13
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.00492a50
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00492a50
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x532778
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4308b4
test al, 1
je 0x4308b4
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x4309f9
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4309ed
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x430968
cmp word [ebp - 0x638], 0x2e
jne 0x430927
mov ax, word [ebp - 0x636]
test ax, ax
je 0x4309d2
cmp ax, 0x2e
jne 0x430927
cmp word [ebp - 0x634], 0
je 0x4309d2
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.00430800
add esp, 4
jmp 0x4309d0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4309bf
test al, 1
je 0x4309bf
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4308f0
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0045945a
mov esp, ebp
pop ebp
ret
Function at 0x430a30
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x430a88
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430a88
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x430a68
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x430a88
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430a83
test al, 0x10
je 0x430a83
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x430a88
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x430d80
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x430daf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.004215a0
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430da7
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x430dd5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x430d92
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x430df0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cb36
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x430e2c
xor eax, eax
jmp 0x431032
cmp word [ebx], 0
je 0x430e25
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430e37
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x430e25
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x531d4c
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430e92
test al, 1
je 0x430e92
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 0x5c
mov dword [ebp - 0x428], 0
mov word [ebp - 0x42c], ax
mov dword [ebp - 0x424], 0
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x884]
call fcn.0042b080
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x430fe2
cmp dword [ebp - 0x424], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
je 0x430f41
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x430f41
cmp word [ebp - 0x858], 0x2e
jne 0x430f41
mov ax, word [ebp - 0x856]
test ax, ax
je 0x430f1c
cmp ax, 0x2e
jne 0x430f41
cmp word [ebp - 0x854], 0
jne 0x430f41
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x43104e
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
jmp 0x430fd4
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x884]
call fcn.0042b5e0
cmp dword [ebp - 0x424], 0
mov byte [ebp - 4], 1
je 0x430f7c
mov eax, dword [ebp - 0x884]
shr eax, 4
and eax, 1
je 0x430f7c
mov esi, dword [ebp - 0x888]
push esi
call fcn.00430df0
jmp 0x430f88
mov esi, dword [ebp - 0x888]
push esi
call fcn.00430d80
mov eax, dword [ebp - 0x428]
add esp, 4
test eax, eax
jne 0x430f99
xor edi, edi
jmp 0x430fb8
cmp dword [ebp - 0x424], 0
jne 0x430fa6
xor edi, edi
jmp 0x430fb8
lea ecx, [ebp - 0x884]
push ecx
push eax
call edi
mov edi, eax
mov dword [ebp - 0x424], edi
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x430fd4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x430ed9
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x424], 0
test eax, eax
je 0x431008
cmp eax, 0xffffffff
je 0x431008
push eax
call esi
mov dword [ebp - 0x428], 0
push ebx
call fcn.00430740
mov eax, dword [ebp - 0x428]
add esp, 4
mov dword [ebp - 0x424], 0
test eax, eax
je 0x43102d
cmp eax, 0xffffffff
je 0x43102d
push eax
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x424], 0
jmp 0x431008
Function at 0x4317e0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4318e1
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4318e1
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0
push 0
push eax
call fcn.00492a50
add esp, 0xc
mov dword [ebp - 0x214], 0x208
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.SOFTWAREHaloDesktop_file_pe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4318d5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x218]
push esi
xor esi, esi
push esi
push esi
push eax
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x4318d3
nop dword [eax]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0x208
push eax
push edi
inc esi
call fcn.004318f0
add esp, 8
lea eax, [ebp - 0x218]
push 0
push 0
push eax
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x210]
call ebx
test eax, eax
je 0x431890
pop esi
pop ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045945a
mov esp, ebp
pop ebp
ret
Function at 0x4320f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432143
push edi
push ebx
call fcn.00436830
mov edi, dword [ebp + 0xc]
push edi
push ebx
push str.call_exe_begin__path__s__cmd__s_
call fcn.004215a0
add esp, 0xc
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
push ebx
call fcn.00436a30
push dword [ebp + 0x14]
push edi
push ebx
push eax
push str.call_exe_return___d___path__s___cmd__s___sync__d_
call fcn.004215a0
add esp, 0x14
pop edi
pop ebx
pop ebp
ret

Function at 0x432200
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x420], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
test eax, eax
je 0x4323a1
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
je 0x4323a1
push 0x208
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], 0
push 0
push eax
call fcn.00492a50
add esp, 0xc
mov dword [ebp - 0x41c], 0x208
lea eax, [ebp - 0x418]
push eax
push 0xf003f
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432395
xor ebx, ebx
lea eax, [ebp - 0x424]
push ebx
push ebx
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x432395
nop dword [eax]
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], 0x208
push 0
push eax
inc ebx
call fcn.00492a50
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004c94fa
add esp, 0x18
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x432365
lea eax, [ebp - 0x20c]
push eax
call edi
test eax, eax
je 0x432365
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x432355
sub esp, 0x28
mov eax, esp
push esi
mov dword [eax + 0x24], 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00434950
add esp, 0x30
jmp 0x432365
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00434810
add esp, 8
push 0
push 0
lea eax, [ebp - 0x424]
push eax
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4322c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045945a
mov esp, ebp
pop ebp
ret
Function at 0x432590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cd22
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x228], esi
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
call fcn.00492a50
add esp, 0xc
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], 0x104
call fcn.00408310
mov ecx, eax
test ecx, ecx
je 0x4326aa
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push eax
lea eax, [ebp - 0x224]
push eax
push 0x52c9c0
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432660
sub eax, edx
sar eax, 1
je 0x43268e
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.0040b750
mov ecx, esi
call fcn.00434d30
mov ecx, esi
call fcn.00434c30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404b60
int3
Function at 0x434430
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51d076
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x533034
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x533034
lea ecx, [ebp - 0x450]
call fcn.00431480
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x438]
call fcn.00431480
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x438]
push eax
push 0x150b
call fcn.00433650
mov edx, dword [ebp - 0x424]
add esp, 0xc
cmp edx, 8
jb 0x43454f
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x434545
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43462e
push edx
push ecx
call fcn.0045904a
add esp, 8
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
cmp edx, 8
jb 0x4345ac
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4345a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x434633
push edx
push ecx
call fcn.0045904a
add esp, 8
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434615
lea eax, [ebp - 0x420]
mov dword [ebp - 0x456], 0
mov dword [ebp - 0x468], eax
xorps xmm0, xmm0
mov eax, 0x614
movlpd qword [ebp - 0x45e], xmm0
mov word [ebp - 0x460], ax
lea eax, [ebp - 0x470]
push eax
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 3
mov dword [ebp - 0x464], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
call fcn.0049c564
call fcn.0049c564
int3
Function at 0x434810
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51d0a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x56c3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43488b
test al, 0x10
je 0x43488b
push esi
mov edi, 1
call fcn.00430740
add esp, 4
test eax, eax
jne 0x4348ae
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4348ae
push esi
test edi, edi
jne 0x4348a6
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4348ae
push esi
push str.DeleteFile:_s_suceesss
call fcn.004215a0
add esp, 8
jmp 0x4348ae
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43485c
push esi
push str.DeleteFile:_s_suceesss
call fcn.004215a0
add esp, 8
jmp 0x4348ae
call fcn.00430740
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43492f
push esi
lea ecx, [ebp - 0x10]
call fcn.0040a230
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [esi + 4]
cmp dword [esi + 8], edi
je 0x4348ee
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00407ff0
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [esi + 4], 4
jmp 0x4348fa
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edi
call fcn.0041fff0
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43491c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435da0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x435e7b
test ecx, ecx
je 0x435e7b
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x435e7b
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x435e7b
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x435e66
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.004cb35d
add esp, 0xc
test eax, eax
je 0x435e8e
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x435e10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.00436bc0
xor ecx, ecx
test edi, edi
je 0x435eac
cmp edi, 0x7fffffff
jbe 0x435eb1
mov ecx, 0x80070057
test ecx, ecx
js 0x435ee7
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x435ecf
cmp word [eax], 0
je 0x435ecf
add eax, 2
sub esi, 1
jne 0x435ec1
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x435ee9
xor esi, esi
test ecx, ecx
js 0x435f3a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x435f2d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x435f2d
movzx eax, word [edi + ecx]
test ax, ax
je 0x435f2d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x435f14
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045945a
mov esp, ebp
pop ebp
ret