joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434db0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00455550
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x434e9f
mov ecx, 0x4c7050
lea eax, [esp]
jmp 0x434e10
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x434e30
test dl, dl
je 0x434e2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x434e30
add eax, 2
add ecx, 2
test dl, dl
jne 0x434e10
xor eax, eax
jmp 0x434e35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x434e83
mov ecx, 0x4c7048
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x434e61
test dl, dl
je 0x434e5d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x434e61
add eax, 2
add ecx, 2
test dl, dl
jne 0x434e41
xor eax, eax
jmp 0x434e66
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x434e83
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004af72c
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004af72c
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004af72c
add esp, 0x50c
ret 4

Function at 0x434ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444190
test eax, eax
je 0x434eeb
mov eax, dword [esp + 8]
test eax, eax
je 0x434eeb
cmp word [eax], 0
je 0x434eeb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x434f07
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x434f07
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x434f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444190
test eax, eax
je 0x434f37
mov eax, dword [esp + 4]
test eax, eax
je 0x434f37
cmp word [eax], 0
je 0x434f37
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x434fa0
Capabilities:
Get file attributes

Disassembly:
call fcn.00444190
test eax, eax
je 0x434fc1
mov eax, dword [esp + 8]
test eax, eax
je 0x434fc1
cmp word [eax], 0
je 0x434fc1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x434fd0
Capabilities:
Set file attributes

Disassembly:
call fcn.00444190
test eax, eax
je 0x434ffb
mov eax, dword [esp + 8]
test eax, eax
je 0x434ffb
cmp word [eax], 0
je 0x434ffb
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x435017
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x435020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
jmp 0x435040
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435040
sub eax, edx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.004128b0
lea ecx, [esp + 0x10]
call fcn.00472810
lea ecx, [esp + 0x10]
call fcn.00472620
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472370
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x64
jle 0x435089
mov eax, edi
jmp 0x43509d
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push str._u._03u
push edx
call fcn.004af76b
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4350b8
sub eax, edx
add eax, ebx
cmp eax, dword [esp + 0x74]
jae 0x43511c
cmp esi, 0x3e8
je 0x43511c
lea eax, [esp + 0x34]
mov edx, eax
mov ecx, ebp
sub ecx, edx
lea edx, [ecx + ebx]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4350e0
call fcn.00444190
test ebp, ebp
je 0x435105
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435105
inc esi
jmp 0x435080
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004af72c
add esp, 0x5c
ret 8
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004af72c
add esp, 0x5c
ret 8

Function at 0x435140
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.00444190
test eax, eax
je 0x4351cf
test esi, esi
je 0x43518b
cmp word [esi], 0
jne 0x435195
test edi, edi
je 0x4351cf
cmp word [edi], 0
je 0x4351cf
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.004555f0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.004555f0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4351d7
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0x1004
ret 0x10
Function at 0x4356e0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.00444190
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x435708
test esi, esi
je 0x435708
cmp word [esi], 0
je 0x435708
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x435715
test edi, edi
je 0x435748
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x435733
cmp byte [esp + 0x14], 0
je 0x43572c
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00434fd0
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x435748
cmp eax, 3
mov eax, 1
jne 0x43574d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x435760
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x435895
cmp byte [ebp], 0
je 0x435895
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x435818
movsx eax, byte [edi]
push eax
call fcn.00455090
test al, al
je 0x4357fa
push esi
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004b0dd0
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.00444190
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x4357ef
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.00434fd0
jmp 0x4357fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x53a388], 0
je 0x435812
push edi
mov ecx, 0x53a288
call fcn.00477000
mov edi, eax
jmp 0x435813
inc edi
cmp byte [edi], 0
jne 0x4357a0
cmp byte [esp + 0x420], 0
pop esi
jne 0x435877
push ebp
call fcn.004557a0
movsx ecx, byte [eax]
push ecx
call fcn.00455090
test al, al
jne 0x435877
call fcn.00444190
push 0
push ebp
call ebx
test eax, eax
je 0x43586c
push 0
push 0
push ebp
call fcn.00434fd0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004af72c
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004af72c
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004af72c
add esp, 0x408
ret 8
Function at 0x4358b0
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x4359eb
cmp word [ebp], 0
je 0x4359eb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x435963
movzx eax, word [edi + ebp]
push eax
call fcn.00455090
test al, al
je 0x435959
push esi
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004b0f9d
xor edx, edx
add esp, 0xc
mov word [esp + esi*2 + 0x14], dx
call fcn.00444190
test eax, eax
je 0x435954
cmp word [esp + 0x14], 0
je 0x435954
push 0
lea eax, [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x43594e
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
call fcn.00434fd0
jmp 0x435959
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x4358f0
cmp byte [esp + 0x820], 0
pop esi
jne 0x4359cd
push ebp
call fcn.00455010
movzx edx, word [eax]
push edx
call fcn.00455090
test al, al
jne 0x4359cd
call fcn.00444190
test eax, eax
je 0x4359c8
cmp word [ebp], 0
je 0x4359c8
push 0
push ebp
call ebx
test eax, eax
je 0x4359c2
push 0
push ebp
push 0
call fcn.00434fd0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004af72c
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004af72c
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004af72c
add esp, 0x808
ret 8
Function at 0x435a50
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.00444190
test eax, eax
je 0x435bee
test esi, esi
je 0x435ab2
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x435ab7
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x435ac5
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x435aca
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x435adc
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x435ae1
mov byte [esp + 0x13], 0
call fcn.00444190
test eax, eax
je 0x435b01
test edi, edi
je 0x435b01
cmp word [edi], 0
je 0x435b01
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x435b0c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x435c09
test al, 1
je 0x435c09
push 0
push edi
push ebp
mov bl, 1
call fcn.00434fd0
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.004555f0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x435bee
cmp byte [esp + 0x12], 0
je 0x435b76
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.004722a0
cmp byte [esp + 0x11], 0
je 0x435b8b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004722a0
cmp byte [esp + 0x13], 0
je 0x435ba0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.004722a0
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x435bee
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00434fd0
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x435b28

Function at 0x435d10
Capabilities:
Set file attributes

Disassembly:
call fcn.00444190
test eax, eax
je 0x435d39
mov eax, dword [esp + 8]
test eax, eax
je 0x435d39
cmp word [eax], 0
je 0x435d39
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x435d53
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x435d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x94]
push ebp
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435d84
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.004128b0
lea ecx, [esp + 0x10]
call fcn.00472810
lea ecx, [esp + 0x10]
call fcn.00472620
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472370
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
cmp esi, 0x64
jbe 0x435dcf
mov eax, edi
jmp 0x435de3
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push 0x4c7064
push edx
mov edx, 0x32
call fcn.00407140
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x435e03
sub eax, edx
sar eax, 1
add eax, ebp
cmp eax, dword [esp + 0xa4]
jae 0x435e71
cmp esi, 0x3e8
je 0x435e71
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x435e34
call fcn.00444190
test eax, eax
je 0x435e6d
test ebx, ebx
je 0x435e6d
cmp word [ebx], 0
je 0x435e6d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x435e6d
inc esi
jmp 0x435dc6
mov eax, ebx
jmp 0x435e73
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0x8c
ret 8
Function at 0x435e90
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c2996
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d88f0]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.00468080
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004af837
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x435f09
mov ecx, 0x5062f4
call fcn.0042c410
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00433d30
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x519774], esi
je 0x435f5e
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.0048bb40
mov edx, dword [0x519774]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.00434440
jmp 0x435f74
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x435f8b
cmp dword [esp + 0xc60], eax
je 0x435f9e
cmp dword [esp + 0xc60], 0
jl 0x435fa3
jg 0x435f9e
cmp eax, 0x10000
jbe 0x435fa3
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00434750
mov edi, eax
test edi, edi
je 0x436068
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x436029
cmp dword [0x519774], eax
je 0x436024
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004b01d0
push edx
push eax
call fcn.0046eb90
push eax
push 0x51e
call fcn.00465ff0
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.00407140
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.0048bb60
call fcn.0048c200
call fcn.004701e0
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.00421a30
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x436052
cmp dword [esp + 0xc60], eax
je 0x435f70
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x435f70
cmp dword [0x519774], 0
je 0x43608d
lea eax, [esp + 0x44]
push eax
call fcn.0048bb60
lea ecx, [esp + 0x844]
push ecx
call fcn.0048baf0
call fcn.0048c200
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4360aa
push eax
call fcn.004af901
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.004680b0
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004af72c
add esp, 0xc40
ret 0x10
Function at 0x4360f0
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x436148
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x436220
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4c29e6
mov eax, dword fs:[0]
push eax
mov eax, 0x18e0
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x18dc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d88f0]
xor eax, esp
push eax
lea eax, [esp + 0x18f4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1904]
mov edi, dword [esp + 0x1908]
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.004339e0
xor ebx, ebx
mov dword [esp + 0x18fc], ebx
push 1
push edi
push esi
lea ecx, [esp + 0x3c]
call fcn.00433e20
test al, al
je 0x43635b
lea ecx, [esp + 0x30]
call fcn.00433d30
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call fcn.004af837
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebx
jne 0x4362cd
mov ecx, 0x5062f4
call fcn.0042c410
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x18fc], 1
push edi
push ebx
push esi
call fcn.004afbb0
add esp, 0xc
xor edi, edi
test ebp, ebp
jl 0x43631a
jg 0x4362f6
cmp dword [esp + 0x1c], edi
jbe 0x43631a
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.00434520
add ebx, 0x10000
adc edi, 0
cmp edi, ebp
jl 0x4362f6
jg 0x43631a
cmp ebx, dword [esp + 0x1c]
jb 0x4362f6
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.00434440
lea ecx, [esp + 0x30]
call fcn.00433cd0
lea ecx, [esp + 0x30]
call fcn.00433a60
mov byte [esp + 0x18fc], 0
test esi, esi
je 0x43635b
push esi
call fcn.004af901
add esp, 4
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push 0x432
lea ecx, [esp + 0xc5c]
push ecx
push edx
lea edi, [esp + 0x14c8]
call fcn.00436150
test al, al
je 0x4363bf
call fcn.00444190
test eax, eax
je 0x4363aa
cmp word [esp + 0xc58], 0
je 0x4363aa
lea eax, [esp + 0xc58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x4363ef
lea ecx, [esp + 0x14bc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x4363ef
call fcn.00444190
test eax, eax
je 0x4363df
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4363df
cmp word [eax], 0
je 0x4363df
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4363e8
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
mov dword [esp + 0x18fc], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00433df0
mov al, bl
mov ecx, dword [esp + 0x18f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18dc]
xor ecx, esp
call fcn.004af72c
add esp, 0x18ec
ret 8
Function at 0x436430
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc9c
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0xc98], eax
push ebx
mov ebx, dword [esp + 0xca4]
push esi
mov esi, dword [esp + 0xcac]
push edi
push 0x432
lea eax, [esp + 0x444]
push eax
push esi
lea edi, [esp + 0x18]
call fcn.00436150
test al, al
je 0x43649b
call fcn.00444190
test eax, eax
je 0x436494
cmp word [esp + 0x440], 0
je 0x436494
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4364be
lea edx, [esp + 0xc]
push edx
jmp 0x4364b8
call fcn.00444190
test eax, eax
je 0x4364b7
test esi, esi
je 0x4364b7
cmp word [esi], 0
je 0x4364b7
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4364be
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xca4]
pop edi
test eax, eax
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0xc9c
ret 8
Function at 0x4364e0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c2a36
mov eax, dword fs:[0]
push eax
mov eax, 0x4178
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x4174], eax
push ebp
push esi
push edi
mov eax, dword [0x4d88f0]
xor eax, esp
push eax
lea eax, [esp + 0x4188]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4198]
push esi
call fcn.004554f0
test al, al
je 0x436779
push esi
call fcn.00434b60
test al, al
je 0x436779
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x4c7094
push ecx
call fcn.004af76b
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0x341
call fcn.00465ff0
push eax
lea eax, [esp + 0x3d8c]
push eax
mov edx, 0x200
call fcn.00407140
add esp, 0xc
lea ecx, [esp + 0x3d84]
push ecx
call fcn.0048bb60
lea ecx, [esp + 0x10]
call fcn.0046fac0
mov dword [esp + 0x4190], 0
lea edx, [esp + 0x3984]
push edx
lea ecx, [esp + 0x14]
call fcn.0046fb60
push 2
push 0
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1568]
call fcn.00468780
mov byte [esp + 0x4190], 1
lea ecx, [esp + 0xccc]
call fcn.004128b0
lea ecx, [esp + 0xcf0]
call fcn.004128b0
lea ecx, [esp + 0xd14]
call fcn.004128b0
lea ecx, [esp + 0xb8]
push ecx
lea ecx, [esp + 0x155c]
call fcn.004692d0
test eax, eax
jne 0x436751
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x436751
cmp byte [esp + 0xb9], 0x3a
jne 0x436751
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x436667
movsx edx, al
movzx eax, cx
cmp eax, edx
jne 0x436751
cmp word [esp + 0x4ba], 0x3a
jne 0x436751
call fcn.00444190
test eax, eax
je 0x436689
cmp word [esp + 0x4b8], 0
je 0x436689
push 0
lea ecx, [esp + 0x4bc]
push ecx
call edi
jmp 0x436695
push 0
lea edx, [esp + 0xbc]
push edx
call ebp
cmp byte [esp + 0xcc8], 0
je 0x4366d3
call fcn.00444190
test eax, eax
je 0x4366c3
cmp word [esp + 0x4b8], 0
je 0x4366c3
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x436735
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x436735
call fcn.00444190
test eax, eax
je 0x4366f7
cmp word [esp + 0x4b8], 0
je 0x4366f7
lea edx, [esp + 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x436705
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x436735
lea ecx, [esp + 0x4b8]
push ecx
push 0x202
call fcn.00465ff0
push eax
push 0
call fcn.00499570
add esp, 0xc
mov ecx, 0x5062f4
call fcn.0042c340
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.004692d0
test eax, eax
je 0x436620
mov byte [esp + 0x4190], 0
lea ecx, [esp + 0x1558]
call fcn.00468a20
mov dword [esp + 0x4190], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401e20
mov ecx, dword [esp + 0x4188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4174]
xor ecx, esp
call fcn.004af72c
add esp, 0x4184
ret 4