joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450aa0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
test edi, edi
jbe 0x450b1e
mov eax, dword [0x4b0b6c]
test eax, eax
je 0x450ad4
mov edx, dword [esp + 0x18]
mov ecx, edi
sub ecx, esi
push ecx
mov ecx, dword [edx + 4]
push ebx
push ecx
call eax
add esp, 0xc
mov dword [esp + 0x20], eax
jmp 0x450b12
mov ecx, dword [esp + 0x18]
mov eax, edi
lea edx, [esp + 0x20]
push 0
sub eax, esi
push edx
mov edx, dword [ecx]
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x450b0e
call fcn.00425340
push eax
call fcn.00425330
add esp, 4
call fcn.00425320
mov ebp, eax
cmp ebp, 4
jne 0x450b31
jmp 0x450ab2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x450b1e
add esi, eax
add ebx, eax
cmp esi, edi
jb 0x450ab2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
sub ebx, eax
pop edi
pop esi
mov dword [ecx], ebx
pop ebp
xor eax, eax
pop ebx
ret
push ebp
call fcn.004939bd
sub edi, esi
push eax
mov eax, dword [esp + 0x1c]
push edi
push ebx
push str.read:_0x_lx___lu:__s
push eax
call fcn.0041c9b0
add esp, 0x18
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x450ba0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
test esi, esi
jbe 0x450c19
mov ebp, dword [esp + 0x18]
mov eax, dword [0x4b0b88]
test eax, eax
je 0x450bd4
mov edx, dword [ebp + 4]
mov ecx, esi
sub ecx, edi
push ecx
push ebx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x450c11
mov edx, dword [ebp]
mov ecx, esi
lea eax, [esp + 0x1c]
push 0
sub ecx, edi
push eax
push ecx
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x450c0d
call fcn.00425340
push eax
call fcn.00425330
add esp, 4
call fcn.00425320
cmp eax, 4
mov dword [esp + 0x20], eax
jne 0x450c26
jmp 0x450bb6
mov eax, dword [esp + 0x1c]
add edi, eax
add ebx, eax
cmp edi, esi
jb 0x450bb6
mov ecx, dword [esp + 0x24]
pop edi
xor eax, eax
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004939bd
sub esi, edi
push eax
mov eax, dword [esp + 0x1c]
push esi
push ebx
push str.write:_0x_x___lu:__s
push eax
call fcn.0041c9b0
mov eax, dword [esp + 0x38]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x458f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea edx, [ecx + eax]
xor eax, eax
cmp ecx, edx
jae 0x458f34
push ebx
imul eax, eax, 0x1000193
xor ebx, ebx
mov bl, byte [ecx]
xor eax, ebx
inc ecx
cmp ecx, edx
jb 0x458f22
pop ebx
ret

Function at 0x467ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xf0
mov ecx, 0x10
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
mov esi, dword [esp + 0xfc]
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov eax, 0x36363636
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov eax, 0x5c5c5c5c
lea edi, [esp + 0xb8]
rep stosd dword es:[edi], eax
mov ecx, 5
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov cl, byte [esp + eax]
mov dl, byte [esp + eax + 0x70]
xor dl, cl
mov byte [esp + eax + 0x70], dl
mov dl, byte [esp + eax + 0xb0]
xor dl, cl
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x40
jl 0x467afe
lea eax, [esp]
push eax
call fcn.004834c0
lea ecx, [esp + 0x74]
push 0x40
lea edx, [esp + 8]
push ecx
push edx
call fcn.004834f0
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.004834f0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x78]
push eax
push ecx
call fcn.004835b0
lea edx, [esp + 0x24]
push edx
call fcn.004834c0
lea eax, [esp + 0xd8]
push 0x40
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.004834f0
lea edx, [esp + 0x90]
push 0x14
lea eax, [esp + 0x38]
push edx
push eax
call fcn.004834f0
mov edx, dword [esp + 0x140]
add esp, 0x40
lea ecx, [esp]
push ecx
push edx
call fcn.004835b0
add esp, 0xf8
ret

Function at 0x468480
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x2c]
mov eax, dword [esi + 0xb8]
test eax, eax
jne 0x4684cb
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
cmp eax, 1
jbe 0x4684bb
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 1
mov dword [esi + 0xb8], ecx
mov eax, ecx
pop esi
add esp, 0x24
ret
mov dword [esi + 0xb8], 1
mov eax, dword [esi + 0xb8]
pop esi
add esp, 0x24
ret
Function at 0x468ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0x2c]
mov esi, dword [eax + 0x30]
push edi
mov eax, dword [ebx]
mov edi, dword [ebx + 0x10]
test eax, eax
mov dword [esp + 0x10], edi
je 0x468aee
test byte [eax + 0x24], 1
jne 0x468aee
push eax
push edi
call fcn.0042a340
add esp, 8
mov ebp, dword [ebx + 4]
mov eax, dword [esi + 0x44]
test ebp, ebp
je 0x468b7c
cmp eax, dword [ebp + 8]
je 0x468b0a
mov ebp, dword [ebp]
test ebp, ebp
jne 0x468afc
jmp 0x468b7c
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x468b15
xor edi, edi
jmp 0x468b2c
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x18]
lea edi, [esp + 0x14]
mov ecx, dword [eax + 0x14]
mov eax, dword [esi + 0x7c]
add ecx, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx]
test eax, eax
je 0x468b46
test byte [eax + 0x24], 1
jne 0x468b46
mov edx, dword [esp + 0x10]
push eax
push edx
call fcn.0042a420
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x468b9c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x468b74
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push edi
lea esi, [eax + 0x3c]
add eax, 0x44
push eax
mov eax, dword [esi]
push eax
push edx
call ecx
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x468bc2
test ebp, ebp
jne 0x468b92
mov edi, dword [esp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x468b92
test byte [ebx + 0x24], 1
jne 0x468b92
push ebx
push edi
call fcn.0042a420
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x468b74
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push edi
lea esi, [eax + 0x3c]
add eax, 0x44
push eax
mov eax, dword [esi]
push eax
push edx
call ecx
mov edi, eax
add esp, 0x10
test edi, edi
je 0x468b74
mov ebx, dword [ebx]
test ebx, ebx
je 0x468bdc
test byte [ebx + 0x24], 1
jne 0x468bdc
mov eax, dword [esp + 0x10]
push ebx
push eax
call fcn.0042a420
add esp, 8
mov eax, dword [esp + 0x38]
test eax, eax
mov eax, str.pgin
jne 0x468bee
mov eax, str.pgout
mov ecx, dword [esi]
mov edx, dword [esp + 0x30]
push ecx
push eax
push edx
call fcn.00431480
add esp, 4
push eax
mov eax, dword [esp + 0x1c]
push str._s:__s_failed_for_page__lu
push eax
call fcn.0041c9b0
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x468eb0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword [0x4b0b74]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test eax, eax
push edi
push ebx
je 0x468eda
call eax
add esp, 8
cmp eax, 0xffffffff
jne 0x468f4a
call fcn.00425320
jmp 0x468f21
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
call ebp
test eax, eax
jne 0x468f4a
call fcn.00425340
mov esi, eax
cmp esi, 0x11
jne 0x468f23
xor esi, esi
call fcn.004733f0
test eax, eax
je 0x468f0d
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x468f4a
jmp 0x468f1c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push ebx
call ebp
test eax, eax
jne 0x468f4a
call fcn.00425340
mov esi, eax
test esi, esi
je 0x468f4a
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x468f4a
push esi
call fcn.004939bd
push eax
mov eax, dword [esp + 0x1c]
push edi
push ebx
push str.Rename__s__s:__s
push eax
call fcn.0041c9b0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4834c0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x49af84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4b9ef0
cmp edx, dword [eax]
je 0x49afa6
add eax, 8
inc ecx
cmp eax, 0x4b9f80
jl 0x49af97
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4b9ef0]
jne 0x49b0d4
mov eax, dword [0x544c34]
cmp eax, 1
je 0x49b0ae
test eax, eax
jne 0x49afd7
cmp dword [0x4b9534], 1
je 0x49b0ae
cmp edx, 0xfc
je 0x49b0d4
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x49b00e
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004999e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00495860
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x49b051
lea eax, [ebp - 0x1a4]
push eax
call fcn.00495860
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4b6a58
push edi
call fcn.00491ef0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004999e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004999f0
lea eax, [ebp - 0xa0]
push 0x4a8db0
push eax
call fcn.004999f0
push dword [esi + 0x4b9ef4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004999f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0049fc57
add esp, 0x2c
pop edi
jmp 0x49b0d4
lea eax, [ebp + 8]
lea esi, [esi + 0x4b9ef4]
push 0
push eax
push dword [esi]
call fcn.00495860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x50cd53cd
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x60ee7d75
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41ca73
Capabilities:
Change the wallpaper

Disassembly:
push ebx
push esi
push edi
mov edi, edx
sub ecx, 0
je 0x41cb1f
sub ecx, 1
je 0x41cb11
sub ecx, 1
je 0x41cb03
sub ecx, 1
je 0x41cad0
sub ecx, 1
jne 0x41cb61
push 1
sub esp, 0x18
mov ecx, esp
push 0x46612c
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.004137aa
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x466128
jmp 0x41cb4d
push 1
sub esp, 0x18
mov ecx, esp
push 0x46c600
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.004137aa
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push 0x46612c
jmp 0x41cb4d
push 1
sub esp, 0x18
mov ecx, esp
push 0x46ca08
jmp 0x41cadc
push 1
sub esp, 0x18
mov ecx, esp
push 0x466114
jmp 0x41cadc
push 1
sub esp, 0x18
mov ebx, 0x46612c
mov ecx, esp
push ebx
call fcn.00402093
mov esi, str.Control_PanelDesktop
push str.WallpaperStyle
mov edx, esi
call fcn.004137aa
add esp, 0x20
push 1
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00402093
push str.TileWallpaper
mov edx, esi
call fcn.004137aa
add esp, 0x20
push 3
push edi
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
pop edi
pop esi
pop ebx
ret

Function at 0x41ce2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov bl, cl
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [0x474b18]
test bl, bl
mov dword [0x474b34], eax
pop ebx
jne 0x41ce54
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0043c208
push eax
push 0x46ce24
push str.CONOUT_
call fcn.00441c72
add esp, 0x10
push 0x4e4
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.0041cde9
push 0x64
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00436f10
lea eax, [ebp - 0x64]
push str._n_tRemcos_v
push eax
call fcn.00441fb0
lea eax, [ebp - 0x64]
push str.5.1.1_Pro
push eax
call fcn.00441fb0
lea eax, [ebp - 0x64]
push 0x46cf28
push eax
call fcn.00441fb0
lea eax, [ebp - 0x64]
push eax
call fcn.0040723b
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x40b460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x442d69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0041cf20
lea edi, [esi + 0xc]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.00422e10
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 1
call fcn.00422e90
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ebx, [esi + 0x38]
mov byte [esp + 0x18], 2
mov ecx, ebx
call fcn.004094f0
push str.ChilkatLog
mov ecx, ebx
mov byte [esp + 0x1c], 3
mov dword [esi], vtable.Logger.1.0
mov dword [edi], vtable.Logger.0
call fcn.00409840
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40baa0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442ed6
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40bac9
lea eax, [esi + 0xc]
jmp 0x40bacb
xor eax, eax
push eax
lea ecx, [esp + 0x10]
call fcn.00422d80
mov al, byte [esi + 4]
mov ebp, dword [esp + 0xa8]
push eax
push ebp
lea ecx, [esi + 0x14]
mov dword [esp + 0xa8], 0
call fcn.00422fe0
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x40bb67
push 0x45082c
call fcn.00409f10
push eax
call fcn.00437f89
mov edi, eax
add esp, 8
test edi, edi
je 0x40bb67
lea ecx, [esp + 0x18]
call fcn.004058d0
mov ecx, dword [esi + 0x30]
mov byte [esp + 0xa0], 1
shl ecx, 2
push ecx
push 0x20
lea ecx, [esp + 0x20]
call fcn.004049a0
push ebp
lea ecx, [esp + 0x1c]
call fcn.004044e0
push eax
push str._s_s:_n
push edi
call fcn.00437f37
push edi
call fcn.00437ee1
add esp, 0x14
lea ecx, [esp + 0x18]
mov byte [esp + 0xa0], 0
call fcn.00405990
mov eax, dword [esi + 0x30]
lea ecx, [esp + 0xc]
inc eax
mov dword [esp + 0xa0], 0xffffffff
mov dword [esi + 0x30], eax
call fcn.00422dd0
mov ecx, dword [esp + 0x98]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x98
ret 8

Function at 0x40c110
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442f9b
push eax
mov eax, 0x18a0
mov dword fs:[0], esp
call fcn.00438540
lea ecx, [esp]
call fcn.004231f0
lea ecx, [esp]
mov dword [esp + 0x18a8], 0
call fcn.00423240
test al, al
je 0x40c179
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00409760
jmp 0x40c1cd
lea edx, [esp + 0x89c]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40c1b9
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x18b4]
call fcn.00409760
jmp 0x40c1cd
mov ecx, dword [esp + 0x18b0]
lea edx, [esp + 0x89c]
push edx
call fcn.00409940
lea ecx, [esp]
mov dword [esp + 0x18a8], 0xffffffff
call fcn.00423230
mov ecx, dword [esp + 0x18a0]
mov dword fs:[0], ecx
add esp, 0x18ac
ret
Function at 0x40c200
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x442fbb
push eax
mov eax, 0x20a4
mov dword fs:[0], esp
call fcn.00438540
lea ecx, [esp]
call fcn.004231f0
lea ecx, [esp]
mov dword [esp + 0x20ac], 0
call fcn.00423240
test al, al
je 0x40c269
lea eax, [esp + 0x89c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x89c]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00409760
jmp 0x40c2c8
lea edx, [esp + 0x10a0]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40c2b4
lea eax, [esp + 0x98]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40c29e
mov byte [esp + 0x98], al
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x20b8]
call fcn.00409760
jmp 0x40c2c8
mov ecx, dword [esp + 0x20b4]
lea edx, [esp + 0x10a0]
push edx
call fcn.00409940
lea ecx, [esp]
mov dword [esp + 0x20ac], 0xffffffff
call fcn.00423230
mov ecx, dword [esp + 0x20a4]
mov dword fs:[0], ecx
add esp, 0x20b0
ret
Function at 0x40c500
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x44303c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x470
push ebx
push esi
lea ecx, [esp + 8]
call fcn.004094f0
mov eax, dword [esp + 0x488]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x484], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b230
lea ecx, [esp + 0x150]
call fcn.004231f0
lea ecx, [esp + 0x150]
mov byte [esp + 0x480], 1
call fcn.00423240
test al, al
lea ecx, [esp + 8]
je 0x40c58d
call fcn.00409f10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x40c65a
call fcn.00409640
cmp eax, 0x104
jle 0x40c69b
lea ecx, [esp + 0x330]
call fcn.004094f0
lea ecx, [esp + 0x330]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x488], 2
call fcn.0040c000
add esp, 8
lea ecx, [esp + 0x1e8]
call fcn.004094f0
push 0x44f8a0
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x484], 3
call fcn.0040a7f0
lea ecx, [esp + 0x330]
call fcn.0040a920
push eax
lea ecx, [esp + 0x1ec]
call fcn.0040a7f0
lea ecx, [esp + 0x1e8]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x40c62f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40c62d
mov esi, 1
test esi, esi
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x480], 2
setne bl
call fcn.00409580
lea ecx, [esp + 0x330]
mov byte [esp + 0x480], 1
call fcn.00409580
lea ecx, [esp + 0x150]
mov byte [esp + 0x480], 0
call fcn.00423230
lea ecx, [esp + 8]
mov dword [esp + 0x480], 0xffffffff
call fcn.00409580
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
add esp, 0x47c
ret
push edi
lea ecx, [esp + 0xc]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x40c6f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x490]
mov ebx, eax
test esi, esi
je 0x40c6e5
push ebp
push ebx
mov ecx, esi
call fcn.0041d180
mov ebp, dword [esi]
lea ecx, [esp + 0x10]
call fcn.0040a920
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call dword [ebp + 0x2c]
pop ebp
cmp ebx, 2
jne 0x40c6ef
mov edi, 1
test edi, edi
lea ecx, [esp + 0x154]
mov byte [esp + 0x484], 0
setne bl
call fcn.00423230
lea ecx, [esp + 0xc]
mov dword [esp + 0x484], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x47c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x47c
ret
Function at 0x40d450
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4430f1
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebp
mov ebp, dword [esp + 0x344]
push esi
mov esi, dword [esp + 0x344]
push edi
mov edi, dword [esp + 0x344]
mov dword [ebp], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.00409640
test eax, eax
jne 0x40d4b7
mov ecx, dword [esp + 0x350]
test ecx, ecx
je 0x40d4b0
mov eax, dword [ecx]
push str.GetAttributes:_filename_is_empty
call dword [eax + 0x14]
xor al, al
jmp 0x40d5eb
push ebx
lea ecx, [esp + 0x10]
call fcn.004094f0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x344], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0x18]
call fcn.0040b230
lea ecx, [esp + 0x10]
call fcn.00409640
lea ecx, [esp + 0x158]
mov edi, eax
call fcn.004231f0
mov bl, 1
cmp edi, 0x104
mov byte [esp + 0x340], bl
jge 0x40d543
lea ecx, [esp + 0x10]
call fcn.00409ef0
test al, al
jne 0x40d528
lea ecx, [esp + 0x158]
call fcn.00423240
test al, al
je 0x40d543
lea ecx, [esp + 0x10]
call fcn.00409f10
push eax
call fcn.0040ed30
add esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40d5ba
jmp 0x40d5b1
test edi, edi
jle 0x40d59a
lea ecx, [esp + 0x1f0]
call fcn.004094f0
lea ecx, [esp + 0x1f0]
lea edx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x348], 2
call fcn.0040c3f0
add esp, 8
lea ecx, [esp + 0x1f0]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x1f0]
mov dword [esi], eax
mov byte [esp + 0x340], bl
call fcn.00409580
jmp 0x40d5ac
lea ecx, [esp + 0x10]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x40d5bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x158]
mov byte [esp + 0x340], 0
setne bl
call fcn.00423230
lea ecx, [esp + 0x10]
mov dword [esp + 0x340], 0xffffffff
call fcn.00409580
mov al, bl
pop ebx
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x334
ret