joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4292e0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x44a07b
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4581b0]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
push 0x20
xor ebx, ebx
mov ebp, 7
push str.4705374c8015e8a66c6d1920f65bc499
lea esi, [esp + 0x74]
mov edi, ecx
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
call fcn.00401aa0
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov ebp, 8
mov byte [esp + 0xb0], 1
cmp dword [edi + 0x18], ebp
jb 0x429372
mov edi, dword [edi + 4]
jmp 0x429375
add edi, 4
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x429386
lea eax, [esp + 0x70]
push edi
push eax
push str._s_s
lea ecx, [esp + 0x24]
call fcn.0042fa83
add esp, 0xc
lea eax, [esp + 0x34]
push ebx
push eax
lea esi, [esp + 0x20]
call fcn.004305ea
add esp, 8
mov byte [esp + 0xb0], 2
mov ecx, dword [esp + 0x38]
mov edi, 0x10
cmp dword [esp + 0x4c], edi
jae 0x4293c6
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x90]
call fcn.004316c2
add esp, 8
lea esi, [esp + 0x50]
mov byte [esp + 0xb0], 3
call fcn.0042f96c
cmp dword [esp + 0x64], 0xa
jb 0x42943f
mov ecx, esi
push 0xa
push ecx
xor ecx, ecx
lea esi, [esp + 0x90]
call fcn.0040db10
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], 4
call fcn.004019b0
mov byte [esp + 0xb0], 3
cmp dword [esp + 0xa0], ebp
jb 0x42943f
mov edx, dword [esp + 0x8c]
push edx
call fcn.00433114
add esp, 4
cmp dword [esp + 0x30], ebp
mov eax, dword [esp + 0x1c]
jae 0x42944d
lea eax, [esp + 0x1c]
push eax
push str.http:__huodong.2345.com_desktop_index.php_d_s
lea ecx, [esp + 0x20]
call fcn.0042fa83
lea eax, [esp + 0x20]
mov byte [esp + 0x1f], bl
push eax
lea ebx, [esp + 0x23]
call fcn.00421ce0
add esp, 0xc
cmp dword [esp + 0x68], ebp
jb 0x429484
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00433114
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x4c], edi
mov esi, 7
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
jb 0x4294ab
mov edx, dword [esp + 0x38]
push edx
call fcn.00433114
add esp, 4
cmp dword [esp + 0x30], ebp
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x4294ce
mov eax, dword [esp + 0x1c]
push eax
call fcn.00433114
add esp, 4
cmp dword [esp + 0x84], ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
jb 0x4294f1
mov ecx, dword [esp + 0x70]
push ecx
call fcn.00433114
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.004337a7
add esp, 0xa0
ret
Function at 0x429c00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44a2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
mov eax, dword [0x4581b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea eax, [esp + 0x13]
push eax
lea edx, [esp + 0x50]
xor ebx, ebx
push edx
mov byte [esp + 0x1b], bl
call fcn.00425a70
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x80], ebx
call fcn.00425e90
add esp, 8
mov byte [esp + 0x78], 1
push 0xc
push str.2345Explorer
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.00401aa0
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x7c], 2
call fcn.00427630
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x429cb3
mov eax, dword [esp + 0x18]
push eax
call fcn.00433114
add esp, 4
cmp dword [esp + 0x48], esi
jb 0x429cc6
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00433114
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
jb 0x429cea
mov edx, dword [esp + 0x50]
push edx
call fcn.00433114
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004337a7
mov esp, ebp
pop ebp
ret
Function at 0x429e10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x84], eax
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 2
mov ecx, 0x12
mov esi, str.Control_PanelDesktopWindowMetrics
lea edi, [esp + 0x50]
xor ebp, ebp
rep movsd dword es:[edi], dword [esi]
push ebp
lea ecx, [esp + 0x54]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429f85
push ebx
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xa
mov ebx, eax
push 0xb
lea edx, [esp + 0x1c]
push edx
lea eax, [ebx - 1]
mov ecx, 8
mov esi, str.Shell_Icon_Size
lea edi, [esp + 0x38]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004345df
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x10
test eax, eax
jne 0x429f30
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429ea0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 1
push 0
lea eax, [esp + 0x3c]
push eax
push ecx
call esi
test eax, eax
jne 0x429f30
call fcn.00429dd0
test eax, eax
je 0x429f30
push 0xa
push 0xb
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.004345df
add esp, 0x10
test eax, eax
jne 0x429f30
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429ef3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
lea edx, [esp + 0x3c]
push edx
push eax
call esi
test eax, eax
jne 0x429f30
call fcn.00429dd0
test eax, eax
je 0x429f30
mov ebp, 1
jmp 0x429f79
push 0xa
push 0xb
lea ecx, [esp + 0x1c]
push ecx
push ebx
call fcn.004345df
add esp, 0x10
test eax, eax
jne 0x429f79
lea eax, [esp + 0x14]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429f50
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 1
push 0
lea ecx, [esp + 0x3c]
push ecx
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [esp + 0x90]
pop edi
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004337a7
add esp, 0x88
ret
Function at 0x42abd0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x23c
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x240]
push esi
push 0
push 2
mov dword [esp + 0x14], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x42ac1e
xor al, al
pop esi
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.004337a7
add esp, 0x23c
ret 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0x22c
call fcn.00434f20
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42acbc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x42ac70
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x40]
call fcn.0042f6f5
test al, al
je 0x42aca6
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x10], eax
je 0x42aca6
push eax
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x42aca6
push 0x1770
push esi
call ebx
push esi
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ac70
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x23c]
pop esi
xor ecx, esp
mov al, 1
call fcn.004337a7
add esp, 0x23c
ret 4
Function at 0x42d150
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x447feb
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.00441af0
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x1024], eax
push ebx
push ebp
push esi
mov eax, dword [0x4581b0]
xor eax, esp
push eax
lea eax, [esp + 0x1038]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1048]
mov ebp, dword [esp + 0x104c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea esi, [eax + 0x94]
push esi
mov dword [esp + 0x1044], ebx
call fcn.00430d56
add esp, 4
test al, al
jne 0x42d1ed
push ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0x44d38c
mov esi, edi
mov word [edi + 4], bx
call fcn.00401aa0
jmp 0x42d291
push 0x1000
lea ecx, [esp + 0x36]
push ebx
push ecx
mov word [esp + 0x3c], bx
call fcn.00434f20
mov eax, 8
add esp, 0xc
cmp dword [esi + 0x18], eax
jb 0x42d214
mov esi, dword [esi + 4]
jmp 0x42d217
add esi, 4
cmp dword [ebp + 0x18], eax
jb 0x42d221
mov ebp, dword [ebp + 4]
jmp 0x42d224
add ebp, 4
push esi
push 0x800
lea edx, [esp + 0x38]
push edx
push 0x44d38c
push ebp
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [eax - 1]
cmp ecx, 0x7fe
ja 0x42d275
mov word [esp + eax*2 + 0x30], bx
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42d257
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x34]
push edx
lea esi, [esp + 0x1c]
call fcn.00401aa0
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push ebx
lea eax, [esp + 0x1c]
mov ecx, edi
mov word [edi + 4], bx
call fcn.004019b0
cmp dword [esp + 0x2c], 8
jb 0x42d2a5
mov eax, dword [esp + 0x18]
push eax
call fcn.00433114
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1038]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004337a7
add esp, 0x1034
ret 8
Function at 0x42e4d0
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x449cfd
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4581b0]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4581b0]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x27c]
push ebp
mov dword [esp + 0x20], ebp
call fcn.00410f10
xor esi, esi
lea edi, [ebp + 0x1c]
mov dword [esp + 0x274], esi
mov eax, 7
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], esi
mov word [edi + 4], si
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x4c], esi
mov word [ebp + 0x3c], si
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x74], esi
mov word [ebp + 0x64], si
mov dword [ebp + 0x94], eax
mov dword [ebp + 0x90], esi
mov word [ebp + 0x80], si
mov dword [ebp + 0xb0], eax
mov dword [ebp + 0xac], esi
mov word [ebp + 0x9c], si
mov dword [ebp + 0xcc], eax
mov dword [ebp + 0xc8], esi
mov word [ebp + 0xb8], si
lea ebx, [ebp + 0xd0]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], esi
mov word [ebx + 4], si
mov dword [ebp + 0x108], eax
mov dword [ebp + 0x104], esi
mov word [ebp + 0xf4], si
push esi
mov byte [esp + 0x278], 8
call fcn.00433a55
add esp, 4
push eax
call fcn.00433a26
add esp, 4
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], esi
call fcn.00407340
call fcn.00431716
cmp dword [ebp + 0xe4], esi
je 0x42e6d3
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], esi
mov word [esp + 0x40], si
push 0x208
lea eax, [esp + 0x5e]
push esi
mov byte [esp + 0x27c], 9
push eax
mov word [esp + 0x64], si
call fcn.00434f20
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x58]
mov word [esp + 0x25e], si
lea edx, [eax + 2]
jmp 0x42e640
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x42e640
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
push eax
lea esi, [esp + 0x44]
call fcn.00401aa0
mov ecx, esi
push str.__r_t_n
push ecx
call fcn.0042f912
add esp, 8
push 9
push str..CEIZ.log
mov ecx, esi
call fcn.0040a5d0
mov edx, esi
push edx
push ebx
lea ecx, [esp + 0x28]
call fcn.0043095b
add esp, 8
push 0xffffffffffffffff
xor edi, edi
push edi
mov ecx, ebx
mov byte [esp + 0x27c], 0xa
call fcn.004019b0
mov esi, 8
cmp dword [esp + 0x38], esi
jb 0x42e6b8
mov eax, dword [esp + 0x24]
push eax
call fcn.00433114
add esp, 4
cmp dword [esp + 0x54], esi
jb 0x42e6cb
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00433114
add esp, 4
mov dword [ebp + 0xec], edi
jmp 0x42e6d9
mov dword [ebp + 0xec], esi
mov eax, ebp
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.004337a7
add esp, 0x264
ret 4
Function at 0x430d56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x447da8
call fcn.004360df
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401920
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00430878
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x430d89
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430d97
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401950
mov al, bl
call fcn.00436129
ret

Function at 0x430da7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x447da8
call fcn.004360df
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401920
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00430878
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x430dda
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430dec
test al, 0x10
jne 0x430dec
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401950
mov al, bl
call fcn.00436129
ret

Function at 0x430dfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x447da8
call fcn.004360df
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401920
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00430878
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x430e2f
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430e41
test al, 0x10
je 0x430e41
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401950
mov al, bl
call fcn.00436129
ret

Function at 0x430e51
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x430e5f
mov eax, dword [esi]
jmp 0x430e61
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430e7c
and eax, 0xfffffffe
push 0
push eax
mov eax, edi
call fcn.004316ea
pop ecx
pop ecx
cmp dword [edi + 0x18], 8
jb 0x430e84
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop esi
ret

Function at 0x431398
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax]
test eax, eax
jne 0x4313a6
xor al, al
leave
ret
cmp dword [eax], 0xffffffff
je 0x4313a2
push edi
lea ecx, [ebp - 4]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4313cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4313cd
xor al, al
jmp 0x4313e8
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0043ced0
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret
Function at 0x431519
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.004315ba
cmp dword [edi + 0x14], 0
je 0x43153a
cmp dword [edi + 0x18], 8
jb 0x431535
mov edi, dword [edi + 4]
jmp 0x43153c
add edi, 4
jmp 0x43153c
xor edi, edi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 4], eax
je 0x431566
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov dword [esi], eax
jmp 0x43156c
mov dword [esi], 1
pop edi
mov eax, esi
pop esi
jmp 0x431575
cmp dword [eax + 4], 0
setne al
ret

Function at 0x4316fd
Capabilities:
Copy file

Disassembly:
jmp 0x4321d9
cmp dword [eax + 0x18], 8
jb 0x4321e4
mov eax, dword [eax + 4]
jmp 0x4321e7
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x4321f2
mov ecx, dword [ecx + 4]
jmp 0x4321f5
add ecx, 4
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
ret

Function at 0x431702
Capabilities:
Delete directory

Disassembly:
jmp 0x432205
cmp dword [eax + 0x18], 8
jb 0x432210
mov eax, dword [eax + 4]
jmp 0x432213
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
ret

Function at 0x431707
Capabilities:
Create directory

Disassembly:
jmp 0x432220
cmp dword [eax + 0x18], 8
jb 0x43222b
mov eax, dword [eax + 4]
jmp 0x43222e
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
ret

Function at 0x43171b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x4c
mov eax, 0x4498b8
call fcn.004360df
mov edi, ecx
push 2
push 0x45016c
mov eax, edi
call fcn.0042f480
cmp eax, 0xffffffff
jne 0x43175d
cmp dword [edi + 0x18], 8
jb 0x431747
mov edi, dword [edi + 4]
jmp 0x43174a
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x43177f
lea esi, [ebp - 0x58]
call fcn.00430c2e
and dword [ebp - 4], 0
mov eax, esi
push eax
push edi
call fcn.0043125d
pop ecx
pop ecx
mov ecx, esi
mov bl, al
call fcn.00430c61
mov al, bl
call fcn.00436129
ret

Function at 0x43206d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4581b0]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x210], 0
push 0x20a
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.00434f20
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4320cd
and word [ebp - 6], 0
push edi
lea edx, [ebp - 0x210]
call fcn.00401980
mov al, 1
jmp 0x4320cf
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004337a7
leave
ret

Function at 0x4320db
Capabilities:
Set file attributes

Disassembly:
cmp dword [esp + 4], 0xffffffff
jne 0x4320e5
xor al, al
ret
and dword [esp + 4], 0xffffb1af
cmp dword [eax + 0x18], 8
jb 0x4320f8
mov eax, dword [eax + 4]
jmp 0x4320fb
add eax, 4
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x43210c
Capabilities:
Move file

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x432117
mov eax, dword [eax + 4]
jmp 0x43211a
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x432125
mov ecx, dword [ecx + 4]
jmp 0x432128
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret

Function at 0x432242
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x432256
mov eax, dword [esi]
jmp 0x432258
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43226a
mov al, 1
jmp 0x4322fb
cmp dword [edi + 0x18], 8
jb 0x432274
mov eax, dword [esi]
jmp 0x432276
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4322f9
cmp dword [edi + 0x18], 8
jb 0x43228f
mov edx, dword [esi]
jmp 0x432291
mov edx, esi
push ebx
lea eax, [ebp - 0x20]
call fcn.00402df0
push 0
lea eax, [ebp - 0x20]
call fcn.004320db
mov bl, al
neg bl
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x20]
inc bl
call fcn.00401950
test bl, bl
pop ebx
jne 0x4322f9
cmp dword [edi + 0x18], 8
jb 0x4322c4
mov eax, dword [esi]
jmp 0x4322c6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x432263
cmp dword [edi + 0x18], 8
jb 0x4322db
mov edx, dword [esi]
jmp 0x4322dd
mov edx, esi
lea eax, [ebp - 0x20]
call fcn.00402df0
push dword [ebp - 4]
lea eax, [ebp - 0x20]
call fcn.004320db
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00401950
xor al, al
pop esi
leave
ret

Function at 0x4322fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4581b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x45953c], edi
je 0x432332
push 0xffffffffffffffff
push edi
mov eax, 0x459528
mov ecx, ebx
call fcn.004019b0
mov al, 1
jmp 0x4323cf
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.00434f20
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4323cd
push esi
push 0x410
lea eax, [ebp - 0x622]
push edi
push eax
mov word [ebp - 6], di
mov word [ebp - 0x624], di
call fcn.00434f20
add esp, 0xc
mov esi, 0x208
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, esi
pop esi
ja 0x4323bc
cmp eax, edi
je 0x4323bc
mov word [ebp + eax*2 - 0x624], di
lea edx, [ebp - 0x624]
jmp 0x4323c2
lea edx, [ebp - 0x210]
push ebx
call fcn.00401980
jmp 0x43232b
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004337a7
leave
ret
Function at 0x4323dc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4581b0]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
and word [ebp - 0x7c], 0
push esi
push edi
push 0x20a
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7a]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.00434f20
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x432429
mov esi, dword [esi + 4]
jmp 0x43242c
add esi, 4
cmp dword [edi + 0x18], 8
jb 0x432437
mov edi, dword [edi + 4]
jmp 0x43243a
add edi, 4
lea eax, [ebp - 0x7c]
push eax
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
pop edi
pop esi
jbe 0x432465
push dword [ebp - 0x80]
and word [ebp + 0x18e], 0
lea edx, [ebp - 0x7c]
call fcn.00401980
mov al, 1
jmp 0x432467
xor al, al
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.004337a7
add ebp, 0x194
leave
ret

Function at 0x432554
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x43255f
mov eax, dword [eax + 4]
jmp 0x432562
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret