joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ff20
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call fcn.00407a90
mov edx, dword [0x494d20]
cmp eax, dword [edx]
jne 0x41ff95
xor ebx, ebx
mov eax, dword [0x4999b8]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41ff5f
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call sub.KERNEL32.DLL_GetTickCount
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041fc00
cmp ebx, 1
jne 0x41ff8f
xor eax, eax
call fcn.0041f7b4
test ebx, ebx
jne 0x41ff48
jmp 0x41ffa1
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call fcn.00407d18
push esp
mov eax, dword [esp + 8]
push eax
call fcn.00407ac0
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041fc00
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x421140
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov eax, dword [0x4977f8]
mov dword [0x491b60], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x491b74]
push eax
mov eax, dword [0x4977f8]
push eax
call fcn.00408100
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42117a
mov edx, fcn.00408000
cmp edx, dword [ebp - 0x24]
je 0x421199
test al, al
je 0x42118f
mov eax, dword [0x4977f8]
push eax
mov eax, dword [0x491b74]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
push 0x491b50
call sub.KERNEL32.DLL_GlobalAddAtomA
push 0x80000000
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4977f8]
push eax
push 0
mov ecx, 0x4211f0
mov edx, dword [0x491b74]
mov eax, 0x80
call fcn.0040857c
mov ebx, eax
cmp word [ebp + 0xa], 0
je 0x4211e4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00421084
push eax
push 0xfffffffffffffffc
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4239a8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4239ae
ret

Function at 0x42ea7c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
call fcn.00407688
cmp dword [eax + 0x10], 0
je 0x42eaa2
call fcn.00407688
mov eax, dword [eax + 0x10]
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x42eb13
mov eax, dword [0x494d14]
cmp dword [eax], 2
jne 0x42eabd
mov eax, dword [0x494958]
cmp dword [eax], 5
jl 0x42eabd
mov esi, 0xfffffffd
jmp 0x42eabf
xor esi, esi
xor ebx, ebx
push 0
push 0x42eb24
push ebx
push esi
call fcn.004080e0
mov ebx, eax
call fcn.00407688
mov dword [eax + 0x10], ebx
call fcn.00407688
mov ebx, dword [eax + 0x10]
call fcn.00407688
cmp dword [eax + 0x10], 0
je 0x42eb13
push 0
call fcn.00407688
mov eax, dword [eax + 0x10]
push eax
call sub.KERNEL32.DLL_InterlockedExchange
mov edi, eax
call fcn.00407a90
cmp edi, eax
jne 0x42eac1
call fcn.00407688
mov eax, dword [eax + 0x10]
pop edi
pop esi
pop ebx
ret
Function at 0x430b84
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x430c03
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_GetFileTime
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x430bed
cmp byte [ebx + 0x40], 0
je 0x430bed
cmp word [ebx + 0x3a], 0
je 0x430bed
push 0
push esi
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_ResumeThread
test eax, eax
jne 0x430bed
lea edx, [ebp - 4]
mov eax, dword [0x494cf8]
call fcn.00407550
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417354]
call fcn.0040dafc
call fcn.00404ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430c0a
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x4314a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x431572
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call fcn.00407b88
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x431544
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call fcn.00407ba8
xor edx, edx
push ebp
push 0x431533
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004030fc
mov eax, dword [ebp - 4]
call fcn.004313dc
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43153a
mov eax, dword [ebp - 8]
push eax
call fcn.00407bb8
ret

Function at 0x431584
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.KERNEL32.DLL_TlsSetValue
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4315f6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4315ca
mov eax, dword [ebp - 8]
push eax
call fcn.00407ba8
mov edx, eax
mov eax, ebx
call fcn.00405728
jmp 0x4315d1
mov eax, ebx
call fcn.00405530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4315fd
cmp dword [ebp - 8], 0
je 0x4315ed
mov eax, dword [ebp - 8]
push eax
call fcn.00407bb8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x431630
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4316d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.004080a0
mov ebx, eax
test bx, bx
je 0x4316ab
mov edx, ebx
mov eax, dword [0x4233ec]
call fcn.00427500
test al, al
je 0x43169b
movzx eax, bx
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov esi, eax
push 9
call sub.KERNEL32.DLL_TlsSetValue
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00427410
call fcn.00404f70
jmp 0x4316df
movzx eax, bx
push eax
call fcn.004080a0
mov ebx, eax
test bx, bx
jne 0x431663
mov ecx, dword [0x4948a4]
mov dl, 1
mov eax, dword [0x408b48]
call fcn.0040dbb8
call fcn.00404ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4316df
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4316e8
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x431740
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.KERNEL32.DLL_TlsSetValue
mov ebx, eax
push 9
call sub.KERNEL32.DLL_TlsSetValue
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431747
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x43181c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x431891
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004313dc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.004274d4
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.KERNEL32.DLL_LoadResource
cmp dword [ebp - 0x10], 0
je 0x43187b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431898
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4318a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x431915
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004313dc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.KERNEL32.DLL_LoadResource
cmp dword [ebp - 0x10], 0
je 0x4318ff
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43191c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x431970
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4319b4
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4319bb
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x438710
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.00437ba8
test al, al
je 0x43879c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push esi
push edi
call sub.KERNEL32.DLL_CreateMutexA
test al, 0x10
je 0x438755
push esi
push edi
call sub.KERNEL32.DLL_EnumResourceNamesA
mov edi, eax
mov cl, 1
mov edx, edi
mov eax, ebx
call fcn.00437a24
mov dword [ebp - 4], eax
jmp 0x438771
push esi
push edi
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x438771
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00437a24
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x438798
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
call fcn.0040a950
mov eax, dword [ebp + 0x10]
call fcn.0040a868
jmp 0x4387af
xor eax, eax
jmp 0x4387af
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
push edi
call sub.KERNEL32.DLL_CreatePipe
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x43b78c
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test esi, esi
je 0x43b7d3
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_FindFirstFileA
test bl, bl
je 0x43b7ae
test ah, 2
jne 0x43b7d3
or eax, 0x200
jmp 0x43b7b8
test ah, 2
je 0x43b7d3
and eax, 0xfffffdff
push eax
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push 0x37
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
pop esi
pop ebx
ret

Function at 0x43b7d8
Capabilities:
Clear file content
Get disk size
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp + 1], cl
mov byte [esp], dl
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov eax, dword [0x499c1c]
cmp esi, dword [eax + 0x30]
jne 0x43b7ff
or edi, 0x8000000
push esi
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, eax
jne 0x43b82e
mov eax, dword [0x499c1c]
cmp esi, dword [eax + 0x30]
jne 0x43b82a
mov eax, dword [0x499c1c]
cmp byte [eax + 0x5b], 0
jne 0x43b82e
xor eax, eax
jmp 0x43b830
mov al, 1
mov byte [esp + 2], al
movzx eax, byte [esp + 2]
or al, bl
je 0x43b845
push 0
push esi
call sub.KERNEL32.DLL_SetThreadLocale
cmp byte [esp], 0
je 0x43b85c
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x43b86b
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
movzx eax, byte [esp + 1]
and al, byte [esp + 2]
jne 0x43b87a
test bl, bl
je 0x43b890
test bl, bl
je 0x43b888
push 6
push esi
call sub.KERNEL32.DLL_SetThreadLocale
jmp 0x43b890
push 5
push esi
call sub.KERNEL32.DLL_SetThreadLocale
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x43f2b8
Capabilities:
Clear file content
Set file attributes

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov edi, eax
cmp dl, byte [edi + 0x271]
je 0x43f44f
mov byte [edi + 0x271], dl
cmp byte [edi + 0x258], 0
je 0x43f2e9
movzx eax, byte [edi + 0x271]
sub al, 2
je 0x43f2ed
sub al, 3
je 0x43f2ed
xor edx, edx
jmp 0x43f2ef
mov dl, 1
mov eax, edi
call fcn.0043cc40
mov eax, edi
call fcn.00458904
test al, al
je 0x43f44f
test byte [edi + 0x1c], 0x10
je 0x43f31f
test byte [edi + 0x1c], 0x10
je 0x43f44f
cmp dword [edi + 0x30], 0
je 0x43f44f
push 0xfffffffffffffff0
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [esp], eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [esp + 4], eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004585f8
push eax
call fcn.00408108
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, edi
mov si, 0xffa9
call fcn.0040484c
lea ecx, [esp + 4]
mov edx, esp
mov eax, edi
mov si, 0xffaa
call fcn.0040484c
mov eax, dword [esp]
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [esp + 8]
push eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov eax, edi
call fcn.00458904
test al, al
je 0x43f42c
mov eax, dword [0x494a10]
cmp byte [eax], 0
je 0x43f40d
cmp byte [edi + 0x271], 3
je 0x43f3f7
mov eax, edi
call fcn.00441144
push eax
push 1
push 0x80
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_HeapFree
jmp 0x43f40d
push 0
push 1
push 0x80
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_HeapFree
push 0xffffffffffffffff
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_FileTimeToDosDateTime
push 0
xor ecx, ecx
mov edx, 0x81
mov eax, edi
call fcn.00451b4c
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x80]
add esp, 0xc
pop edi
pop esi
ret
Function at 0x43f6d8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp bl, byte [eax + 0x277]
je 0x43f847
test bl, bl
jne 0x43f703
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 3
je 0x43f714
cmp bl, 3
jne 0x43f772
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 0
jne 0x43f772
mov eax, dword [ebp - 4]
mov byte [eax + 0x277], bl
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x43f847
mov eax, dword [ebp - 4]
call fcn.00458904
test al, al
je 0x43f847
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 3
sete al
and eax, 0x7f
mov eax, dword [eax*4 + 0x49256c]
push eax
mov eax, dword [ebp - 4]
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
jmp 0x43f847
cmp bl, 1
jne 0x43f78d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x278], 0
jne 0x43f78d
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0043fbe0
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
setne al
xor al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43f7ac
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00459998
xor edx, edx
push ebp
push 0x43f840
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 5], 0
je 0x43f7cb
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xb0]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x277]
mov edx, dword [ebp - 4]
mov byte [edx + 0x277], bl
cmp bl, 2
je 0x43f7e7
cmp al, 2
jne 0x43f805
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d9], 0
jne 0x43f805
mov eax, dword [ebp - 4]
call fcn.0043fd18
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00450a08
cmp byte [ebp - 5], 0
je 0x43f813
mov eax, dword [ebp - 4]
call fcn.004551b8
cmp bl, 1
jne 0x43f822
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0043e40c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f847
cmp byte [ebp - 5], 0
je 0x43f83f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00459998
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43f84c
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
cmp byte [ebp + 0x277], 2
jne 0x43f8c0
cmp dword [ebp + 0x29c], 0
je 0x43f8c0
xor esi, esi
mov eax, dword [ebp + 0x290]
test eax, eax
je 0x43f877
mov edx, dword [eax]
call dword [edx + 0x34]
mov esi, eax
xor edi, edi
mov eax, dword [ebp + 0x2a0]
test eax, eax
je 0x43f88a
call fcn.00434a54
mov edi, eax
mov eax, ebp
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
cmp esi, eax
setne bl
push edi
push esi
push 0x230
mov eax, dword [ebp + 0x29c]
push eax
call sub.KERNEL32.DLL_HeapFree
test bl, bl
je 0x43f8c0
mov eax, ebp
call fcn.004585f8
push eax
call fcn.00408060
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43f914
Capabilities:
Create directory
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43fb28
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x43f9a8
mov eax, dword [0x499c20]
call fcn.00443e04
dec eax
test eax, eax
jl 0x43f9a8
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov edx, edi
mov eax, dword [0x499c20]
call fcn.00443df0
cmp esi, dword [eax + 0x290]
jne 0x43f9a2
mov edx, edi
mov eax, dword [0x499c20]
call fcn.00443df0
cmp ebx, eax
je 0x43f9a2
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x4948ec]
call fcn.00407550
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4173b0]
call fcn.0040db38
call fcn.00404ec4
inc edi
dec dword [ebp - 4]
jne 0x43f94d
mov eax, dword [ebx + 0x290]
test eax, eax
je 0x43f9b9
xor edx, edx
call fcn.004382c8
test byte [ebx + 0x1c], 8
jne 0x43f9c9
test esi, esi
je 0x43f9cb
test byte [esi + 0x1c], 8
je 0x43f9cb
xor esi, esi
mov dword [ebx + 0x290], esi
test esi, esi
je 0x43f9de
mov edx, ebx
mov eax, esi
call fcn.00420098
test esi, esi
je 0x43fa91
test byte [ebx + 0x1c], 0x10
jne 0x43f9f9
cmp byte [ebx + 0x271], 3
je 0x43fa91
mov eax, dword [ebx + 0x290]
cmp byte [eax + 0x5c], 0
jne 0x43fa0e
cmp byte [ebx + 0x277], 1
jne 0x43fa14
test byte [ebx + 0x1c], 0x10
je 0x43fa6c
mov eax, ebx
call fcn.00458904
test al, al
je 0x43faab
mov eax, dword [ebx + 0x290]
mov edx, dword [eax]
call dword [edx + 0x34]
mov edi, eax
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
cmp edi, eax
je 0x43fa5a
mov eax, dword [ebx + 0x290]
mov edx, dword [eax]
call dword [edx + 0x34]
push eax
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_MoveFileA
mov eax, ebx
call fcn.004585f8
mov edx, eax
mov eax, esi
call fcn.004382c8
jmp 0x43faab
cmp byte [ebx + 0x277], 1
je 0x43faab
mov eax, ebx
call fcn.00458904
test al, al
je 0x43faab
push 0
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_MoveFileA
jmp 0x43faab
mov eax, ebx
call fcn.00458904
test al, al
je 0x43faab
push 0
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp byte [ebx + 0x276], 0
je 0x43fabd
mov dl, 1
mov eax, ebx
call fcn.00440fd0
mov eax, ebx
call fcn.0043f84c
cmp dword [ebx + 0x298], 0
je 0x43fb12
test byte [ebx + 0x1c], 0x10
je 0x43fb12
cmp dword [ebx + 0x30], 0
je 0x43fb12
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
xor ecx, ecx
mov edx, 0x85
mov eax, ebx
call fcn.00451b4c
push 0
xor ecx, ecx
mov edx, 0xf
mov eax, ebx
call fcn.00451b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fb2f
lea eax, [ebp - 0x10]
call fcn.00405530
ret
Function at 0x443430
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebx
push esi
mov ebx, eax
test byte [ebx + 0x1c], 0x10
jne 0x443503
cmp dword [0x492504], 0
je 0x443503
mov eax, ebx
call fcn.00458904
test al, al
je 0x443503
push 0xffffffffffffffec
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp byte [ebx + 0x328], 0
jne 0x44347d
cmp byte [ebx + 0x350], 0
je 0x4434d7
test esi, 0x80000
jne 0x44349b
or esi, 0x80000
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetEndOfFile
movzx eax, byte [ebx + 0x328]
mov eax, dword [eax*4 + 0x492598]
movzx edx, byte [ebx + 0x350]
or eax, dword [edx*4 + 0x4925a0]
push eax
movzx eax, byte [ebx + 0x329]
push eax
mov eax, dword [ebx + 0x354]
push eax
mov eax, ebx
call fcn.004585f8
push eax
call dword [0x492504]
jmp 0x443503
and esi, 0xfff7ffff
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0x485
push 0
push 0
mov eax, ebx
call fcn.004585f8
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
pop esi
pop ebx
ret