joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4354c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00455ca0
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4355af
mov ecx, 0x4c8050
lea eax, [esp]
jmp 0x435520
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x435540
test dl, dl
je 0x43553c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x435540
add eax, 2
add ecx, 2
test dl, dl
jne 0x435520
xor eax, eax
jmp 0x435545
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x435593
mov ecx, 0x4c8048
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x435571
test dl, dl
je 0x43556d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x435571
add eax, 2
add ecx, 2
test dl, dl
jne 0x435551
xor eax, eax
jmp 0x435576
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x435593
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004affec
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004affec
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004affec
add esp, 0x50c
ret 4

Function at 0x4355d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444860
test eax, eax
je 0x4355fb
mov eax, dword [esp + 8]
test eax, eax
je 0x4355fb
cmp word [eax], 0
je 0x4355fb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x435617
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435617
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x435620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444860
test eax, eax
je 0x435647
mov eax, dword [esp + 4]
test eax, eax
je 0x435647
cmp word [eax], 0
je 0x435647
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x4356b0
Capabilities:
Get file attributes

Disassembly:
call fcn.00444860
test eax, eax
je 0x4356d1
mov eax, dword [esp + 8]
test eax, eax
je 0x4356d1
cmp word [eax], 0
je 0x4356d1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x4356e0
Capabilities:
Set file attributes

Disassembly:
call fcn.00444860
test eax, eax
je 0x43570b
mov eax, dword [esp + 8]
test eax, eax
je 0x43570b
cmp word [eax], 0
je 0x43570b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x435727
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x435730
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
jmp 0x435750
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435750
sub eax, edx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.004128b0
lea ecx, [esp + 0x10]
call fcn.00473090
lea ecx, [esp + 0x10]
call fcn.00472ea0
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472bf0
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x64
jle 0x435799
mov eax, edi
jmp 0x4357ad
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push str._u._03u
push edx
call fcn.004b002b
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4357c8
sub eax, edx
add eax, ebx
cmp eax, dword [esp + 0x74]
jae 0x43582c
cmp esi, 0x3e8
je 0x43582c
lea eax, [esp + 0x34]
mov edx, eax
mov ecx, ebp
sub ecx, edx
lea edx, [ecx + ebx]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4357f0
call fcn.00444860
test ebp, ebp
je 0x435815
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435815
inc esi
jmp 0x435790
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004affec
add esp, 0x5c
ret 8
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004affec
add esp, 0x5c
ret 8

Function at 0x435850
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.00444860
test eax, eax
je 0x4358df
test esi, esi
je 0x43589b
cmp word [esi], 0
jne 0x4358a5
test edi, edi
je 0x4358df
cmp word [edi], 0
je 0x4358df
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.00455d40
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.00455d40
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4358e7
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x1004
ret 0x10
Function at 0x435df0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.00444860
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x435e18
test esi, esi
je 0x435e18
cmp word [esi], 0
je 0x435e18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x435e25
test edi, edi
je 0x435e58
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x435e43
cmp byte [esp + 0x14], 0
je 0x435e3c
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.004356e0
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x435e58
cmp eax, 3
mov eax, 1
jne 0x435e5d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x435e70
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x435fa5
cmp byte [ebp], 0
je 0x435fa5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x435f28
movsx eax, byte [edi]
push eax
call fcn.004557e0
test al, al
je 0x435f0a
push esi
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004b1690
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.00444860
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x435eff
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.004356e0
jmp 0x435f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x53b388], 0
je 0x435f22
push edi
mov ecx, 0x53b288
call fcn.00477880
mov edi, eax
jmp 0x435f23
inc edi
cmp byte [edi], 0
jne 0x435eb0
cmp byte [esp + 0x420], 0
pop esi
jne 0x435f87
push ebp
call fcn.00455ef0
movsx ecx, byte [eax]
push ecx
call fcn.004557e0
test al, al
jne 0x435f87
call fcn.00444860
push 0
push ebp
call ebx
test eax, eax
je 0x435f7c
push 0
push 0
push ebp
call fcn.004356e0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004affec
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004affec
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004affec
add esp, 0x408
ret 8
Function at 0x435fc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x4360fb
cmp word [ebp], 0
je 0x4360fb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x436073
movzx eax, word [edi + ebp]
push eax
call fcn.004557e0
test al, al
je 0x436069
push esi
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.004b185d
xor edx, edx
add esp, 0xc
mov word [esp + esi*2 + 0x14], dx
call fcn.00444860
test eax, eax
je 0x436064
cmp word [esp + 0x14], 0
je 0x436064
push 0
lea eax, [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x43605e
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
call fcn.004356e0
jmp 0x436069
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x436000
cmp byte [esp + 0x820], 0
pop esi
jne 0x4360dd
push ebp
call fcn.00455760
movzx edx, word [eax]
push edx
call fcn.004557e0
test al, al
jne 0x4360dd
call fcn.00444860
test eax, eax
je 0x4360d8
cmp word [ebp], 0
je 0x4360d8
push 0
push ebp
call ebx
test eax, eax
je 0x4360d2
push 0
push ebp
push 0
call fcn.004356e0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004affec
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004affec
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004affec
add esp, 0x808
ret 8
Function at 0x436160
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.00444860
test eax, eax
je 0x4362fe
test esi, esi
je 0x4361c2
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x4361c7
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x4361d5
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x4361da
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4361ec
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x4361f1
mov byte [esp + 0x13], 0
call fcn.00444860
test eax, eax
je 0x436211
test edi, edi
je 0x436211
cmp word [edi], 0
je 0x436211
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x43621c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x436319
test al, 1
je 0x436319
push 0
push edi
push ebp
mov bl, 1
call fcn.004356e0
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00455d40
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4362fe
cmp byte [esp + 0x12], 0
je 0x436286
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.00472b20
cmp byte [esp + 0x11], 0
je 0x43629b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00472b20
cmp byte [esp + 0x13], 0
je 0x4362b0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.00472b20
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x4362fe
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.004356e0
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x436238

Function at 0x436420
Capabilities:
Set file attributes

Disassembly:
call fcn.00444860
test eax, eax
je 0x436449
mov eax, dword [esp + 8]
test eax, eax
je 0x436449
cmp word [eax], 0
je 0x436449
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x436463
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x436470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x8c
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
mov ebx, dword [esp + 0x94]
push ebp
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436494
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.004128b0
lea ecx, [esp + 0x10]
call fcn.00473090
lea ecx, [esp + 0x10]
call fcn.00472ea0
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00472bf0
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
cmp esi, 0x64
jbe 0x4364df
mov eax, edi
jmp 0x4364f3
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push 0x4c8064
push edx
mov edx, 0x32
call fcn.00407130
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x436513
sub eax, edx
sar eax, 1
add eax, ebp
cmp eax, dword [esp + 0xa4]
jae 0x436581
cmp esi, 0x3e8
je 0x436581
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x436544
call fcn.00444860
test eax, eax
je 0x43657d
test ebx, ebx
je 0x43657d
cmp word [ebx], 0
je 0x43657d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x43657d
inc esi
jmp 0x4364d6
mov eax, ebx
jmp 0x436583
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x8c
ret 8
Function at 0x4365a0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c3286
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.00468900
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004b00f7
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x436619
mov ecx, 0x5072f4
call fcn.0042cb70
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00434440
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x51a774], esi
je 0x43666e
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.0048c3f0
mov edx, dword [0x51a774]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.00434b50
jmp 0x436684
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x43669b
cmp dword [esp + 0xc60], eax
je 0x4366ae
cmp dword [esp + 0xc60], 0
jl 0x4366b3
jg 0x4366ae
cmp eax, 0x10000
jbe 0x4366b3
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00434e60
mov edi, eax
test edi, edi
je 0x436778
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x436739
cmp dword [0x51a774], eax
je 0x436734
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004b0a90
push edx
push eax
call fcn.0046f410
push eax
push 0x51e
call fcn.00466860
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.00407130
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.0048c410
call fcn.0048cab0
call fcn.00470a60
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.00422180
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x436762
cmp dword [esp + 0xc60], eax
je 0x436680
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x436680
cmp dword [0x51a774], 0
je 0x43679d
lea eax, [esp + 0x44]
push eax
call fcn.0048c410
lea ecx, [esp + 0x844]
push ecx
call fcn.0048c3a0
call fcn.0048cab0
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4367ba
push eax
call fcn.004b01c1
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00468930
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004affec
add esp, 0xc40
ret 0x10
Function at 0x436800
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x436858
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x436930
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4c32d6
mov eax, dword fs:[0]
push eax
mov eax, 0x18e0
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x18dc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x18f4]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1904]
mov edi, dword [esp + 0x1908]
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.004340f0
xor ebx, ebx
mov dword [esp + 0x18fc], ebx
push 1
push edi
push esi
lea ecx, [esp + 0x3c]
call fcn.00434530
test al, al
je 0x436a6b
lea ecx, [esp + 0x30]
call fcn.00434440
mov edi, 0x10000
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call fcn.004b00f7
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
cmp esi, ebx
jne 0x4369dd
mov ecx, 0x5072f4
call fcn.0042cb70
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov byte [esp + 0x18fc], 1
push edi
push ebx
push esi
call fcn.004b0470
add esp, 0xc
xor edi, edi
test ebp, ebp
jl 0x436a2a
jg 0x436a06
cmp dword [esp + 0x1c], edi
jbe 0x436a2a
push 0x10000
push esi
lea ecx, [esp + 0x38]
call fcn.00434c30
add ebx, 0x10000
adc edi, 0
cmp edi, ebp
jl 0x436a06
jg 0x436a2a
cmp ebx, dword [esp + 0x1c]
jb 0x436a06
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
call fcn.00434b50
lea ecx, [esp + 0x30]
call fcn.004343e0
lea ecx, [esp + 0x30]
call fcn.00434170
mov byte [esp + 0x18fc], 0
test esi, esi
je 0x436a6b
push esi
call fcn.004b01c1
add esp, 4
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push 0x432
lea ecx, [esp + 0xc5c]
push ecx
push edx
lea edi, [esp + 0x14c8]
call fcn.00436860
test al, al
je 0x436acf
call fcn.00444860
test eax, eax
je 0x436aba
cmp word [esp + 0xc58], 0
je 0x436aba
lea eax, [esp + 0xc58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
jmp 0x436aff
lea ecx, [esp + 0x14bc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne bl
jmp 0x436aff
call fcn.00444860
test eax, eax
je 0x436aef
mov eax, dword [esp + 0x18]
test eax, eax
je 0x436aef
cmp word [eax], 0
je 0x436aef
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x436af8
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
mov bl, al
mov dword [esp + 0x18fc], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00434500
mov al, bl
mov ecx, dword [esp + 0x18f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18dc]
xor ecx, esp
call fcn.004affec
add esp, 0x18ec
ret 8
Function at 0x436b40
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc9c
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0xc98], eax
push ebx
mov ebx, dword [esp + 0xca4]
push esi
mov esi, dword [esp + 0xcac]
push edi
push 0x432
lea eax, [esp + 0x444]
push eax
push esi
lea edi, [esp + 0x18]
call fcn.00436860
test al, al
je 0x436bab
call fcn.00444860
test eax, eax
je 0x436ba4
cmp word [esp + 0x440], 0
je 0x436ba4
lea ecx, [esp + 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x436bce
lea edx, [esp + 0xc]
push edx
jmp 0x436bc8
call fcn.00444860
test eax, eax
je 0x436bc7
test esi, esi
je 0x436bc7
cmp word [esi], 0
je 0x436bc7
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x436bce
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xca4]
pop edi
test eax, eax
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0xc9c
ret 8
Function at 0x436bf0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4c3326
mov eax, dword fs:[0]
push eax
mov eax, 0x4178
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x4174], eax
push ebp
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x4188]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4198]
push esi
call fcn.00455c40
test al, al
je 0x436e89
push esi
call fcn.00435270
test al, al
je 0x436e89
movsx eax, byte [esi]
push eax
lea ecx, [esp + 0x3988]
push 0x4c8094
push ecx
call fcn.004b002b
movsx edx, byte [esp + 0x3990]
add esp, 0xc
push edx
push 0x341
call fcn.00466860
push eax
lea eax, [esp + 0x3d8c]
push eax
mov edx, 0x200
call fcn.00407130
add esp, 0xc
lea ecx, [esp + 0x3d84]
push ecx
call fcn.0048c410
lea ecx, [esp + 0x10]
call fcn.00470340
mov dword [esp + 0x4190], 0
lea edx, [esp + 0x3984]
push edx
lea ecx, [esp + 0x14]
call fcn.004703e0
push 2
push 0
push 2
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1568]
call fcn.00469000
mov byte [esp + 0x4190], 1
lea ecx, [esp + 0xccc]
call fcn.004128b0
lea ecx, [esp + 0xcf0]
call fcn.004128b0
lea ecx, [esp + 0xd14]
call fcn.004128b0
lea ecx, [esp + 0xb8]
push ecx
lea ecx, [esp + 0x155c]
call fcn.00469b50
test eax, eax
jne 0x436e61
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov al, byte [esi]
cmp byte [esp + 0xb8], al
jne 0x436e61
cmp byte [esp + 0xb9], 0x3a
jne 0x436e61
mov cx, word [esp + 0x4b8]
test cx, cx
je 0x436d77
movsx edx, al
movzx eax, cx
cmp eax, edx
jne 0x436e61
cmp word [esp + 0x4ba], 0x3a
jne 0x436e61
call fcn.00444860
test eax, eax
je 0x436d99
cmp word [esp + 0x4b8], 0
je 0x436d99
push 0
lea ecx, [esp + 0x4bc]
push ecx
call edi
jmp 0x436da5
push 0
lea edx, [esp + 0xbc]
push edx
call ebp
cmp byte [esp + 0xcc8], 0
je 0x436de3
call fcn.00444860
test eax, eax
je 0x436dd3
cmp word [esp + 0x4b8], 0
je 0x436dd3
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x436e45
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x436e45
call fcn.00444860
test eax, eax
je 0x436e07
cmp word [esp + 0x4b8], 0
je 0x436e07
lea edx, [esp + 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x436e15
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
test al, al
jne 0x436e45
lea ecx, [esp + 0x4b8]
push ecx
push 0x202
call fcn.00466860
push eax
push 0
call fcn.00499df0
add esp, 0xc
mov ecx, 0x5072f4
call fcn.0042caa0
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x155c]
call fcn.00469b50
test eax, eax
je 0x436d30
mov byte [esp + 0x4190], 0
lea ecx, [esp + 0x1558]
call fcn.004692a0
mov dword [esp + 0x4190], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401e20
mov ecx, dword [esp + 0x4188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4174]
xor ecx, esp
call fcn.004affec
add esp, 0x4184
ret 4