joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418f20
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x570
push ebx
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
push 0x7f00
rep stosd dword es:[edi], eax
push eax
mov dword [esp + 0x34], 6
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esp + 0x14], 0x4190a0
mov dword [esp + 0x34], str.Server
mov ebx, dword [esp + 0x580]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ebx
push eax
mov dword [esp + 0x14], 3
call dword [sym.imp.USER32.dll_RegisterClassW]
mov ecx, 0x80
lea edi, [esp + 0x17c]
mov esi, dword [esp + 0x588]
lea edx, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x7c]
lea eax, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x184]
push eax
push ecx
call fcn.00438850
add esp, 0x10
call fcn.00438ba0
mov eax, dword [esp + 0xc]
mov word [0x46ae3c], 0
fstp qword [0x694cb8]
cmp eax, 1
jl 0x418ffe
mov edx, dword [esp + 0x54]
push 0x104
push edx
push 0x46ae3c
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0xc
push 0
push ebx
push 0
push 0
push bind
push bind
push bind
push bind
push 0x2cf0000
push str.Server
push str.Server
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 7
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
lea eax, [esp + 0x40]
push 0
push eax
call esi
test eax, eax
je 0x419084
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [esp + 0x38]
push ecx
call edi
lea edx, [esp + 0x38]
push edx
call ebx
push 0
push 0
lea eax, [esp + 0x40]
push 0
push eax
call esi
test eax, eax
jne 0x419065
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebx
add esp, 0x570
ret 0x10
Function at 0x41be30
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41be67
mov ecx, dword [0x694cac]
push str.ERROR:_WSAStartup__
push ecx
call fcn.00437650
add esp, 8
or eax, 0xffffffff
add esp, 0x1a0
ret
cmp word [esp + 0x10], 0x202
je 0x41be8e
mov edx, dword [0x694cac]
push str.ERROR:_Wrong_version_of_winsock
push edx
call fcn.00437650
add esp, 8
or eax, 0xffffffff
add esp, 0x1a0
ret
push 6
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [0x458720], eax
jne 0x41bec0
mov eax, dword [0x694cac]
push str.ERROR:_Calling_socket__
push eax
call fcn.00437650
add esp, 8
or eax, 0xffffffff
add esp, 0x1a0
ret
mov ecx, dword [0x694ca8]
push 8
push 0x40a
push ecx
push eax
call sub.WS2_32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x41bf02
mov edx, dword [0x694cac]
push str.ERROR:_WSAAsyncSelect__
push edx
call fcn.00437650
mov eax, dword [0x458720]
add esp, 8
push eax
call sub.WS2_32.dll_closesocket
or eax, 0xffffffff
add esp, 0x1a0
ret
mov ecx, dword [esp + 0x1a4]
push ecx
call sub.WS2_32.dll_htons
mov word [esp + 2], ax
mov eax, dword [0x458720]
lea edx, [esp]
push 0x10
push edx
push eax
mov word [esp + 0xc], 2
mov dword [esp + 0x10], 0
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jne 0x41bf41
push str.ERROR:_bind__
jmp 0x41bf58
mov eax, dword [0x458720]
push 5
push eax
call sub.WS2_32.dll_listen
cmp eax, 0xffffffff
jne 0x41bf7d
push str.ERROR:_listen__
mov ecx, dword [0x694cac]
push ecx
call fcn.00437650
mov edx, dword [0x458720]
add esp, 8
push edx
call sub.WS2_32.dll_closesocket
or eax, 0xffffffff
add esp, 0x1a0
ret
xor eax, eax
add esp, 0x1a0
ret

Function at 0x41c7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x100
push esi
mov esi, dword [esp + 0x108]
push 1
push esi
call sub.WS2_32.dll_shutdown
push 0
lea eax, [esp + 8]
push 0x100
push eax
push esi
call sub.WS2_32.dll_recv
test eax, eax
je 0x41c827
cmp eax, 0xffffffff
je 0x41c827
push 0
lea ecx, [esp + 8]
push 0x100
push ecx
push esi
call sub.WS2_32.dll_recv
test eax, eax
jne 0x41c80c
push 2
push esi
call sub.WS2_32.dll_shutdown
push esi
call sub.WS2_32.dll_closesocket
pop esi
add esp, 0x100
ret
Function at 0x41c840
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
xor edi, edi
call fcn.0041c320
add esp, 4
mov ebx, eax
test ebx, ebx
push edi
jne 0x41c876
push edi
push str.NULL_pointer_in_read
push edi
push 0xffffffffffffffff
push edi
push 4
call fcn.00426440
add esp, 0x1c
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xbb8
push 0x465110
push esi
call sub.WS2_32.dll_recv
mov ebp, eax
test ebp, ebp
je 0x41c93f
cmp ebp, 0xffffffff
je 0x41c9e9
mov eax, dword [ebx + 0xc]
mov esi, 0x2800
test eax, eax
jne 0x41c8fd
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
jne 0x41c8bf
push eax
push eax
push str.read_on_sock_1_
jmp 0x41c92f
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], esi
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
lea edx, [ecx + ebp]
cmp edx, eax
jbe 0x41c947
add eax, 0x2800
push eax
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
test eax, eax
je 0x41c926
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x14]
add eax, esi
mov dword [ebx + 0x14], eax
jmp 0x41c991
cmp dword [ebx + 0x14], 0x1000000
jb 0x41c8c9
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 1
call fcn.00426440
add esp, 0x1c
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push 0
push str.read_on_sock_2_
push 0
push 0xffffffffffffffff
push 0
push 2
call fcn.00426440
add esp, 0x1c
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov edx, eax
sub edx, ecx
sub edx, ebp
cmp edx, esi
jbe 0x41c991
add eax, 0xffffd800
push eax
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
test eax, eax
je 0x41c978
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0x14]
add eax, 0xffffd800
mov dword [ebx + 0x14], eax
jmp 0x41c991
push 0
push 0
push str.read_on_sock_3_
push 0
push 0xffffffffffffffff
push 0
push 2
call fcn.00426440
add esp, 0x1c
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea ecx, [eax + ebp]
cmp ecx, edx
jbe 0x41c9be
push 0
push 0
push str.Buffer_overflow
push 0
push 0xffffffffffffffff
push 0
push 4
call fcn.00426440
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [ebx + 0xc]
mov ecx, ebp
mov edx, ecx
mov esi, 0x465110
add edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x10]
mov edi, ebp
add eax, ebp
mov dword [ebx + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x2733
pop edi
neg eax
pop esi
pop ebp
sbb eax, eax
pop ebx
ret
Function at 0x41ca00
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.0041c320
mov esi, eax
add esp, 4
test esi, esi
jne 0x41ca30
push eax
push eax
push str.NULL_pointer_in_write
push eax
push 0xffffffffffffffff
push eax
push 4
call fcn.00426440
add esp, 0x1c
or eax, 0xffffffff
pop edi
pop esi
ret
mov al, byte [esi + 8]
test al, al
jne 0x41ca3d
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x41ca9e
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41ca9e
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41ca9e
push 0
push eax
mov eax, dword [esi + 0x18]
push eax
push edi
call sub.WS2_32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x41ca7f
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x41ca79
mov dword [esi + 0x24], 1
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
sub ecx, edi
lea edx, [eax + edi]
push ecx
push edx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [esi + 0x1c]
add esp, 0xc
sub eax, edi
mov dword [esi + 0x1c], eax
pop edi
xor eax, eax
pop esi
ret
Function at 0x426b20
Capabilities:
Copy file

Disassembly:
mov eax, dword [0x458724]
sub esp, 0x308
test eax, eax
jne 0x426b41
mov eax, dword [esp + 0x30c]
test eax, eax
je 0x426b41
mov eax, 1
jmp 0x426b43
xor eax, eax
push ebx
push esi
push 0x4739b8
push 0x46c69c
push eax
mov eax, dword [0x694ca8]
push 0x46f8f0
push 0x46ac34
push 8
push eax
call fcn.004090d0
mov ebx, dword [sym.imp.MSVCRT.dll_swprintf]
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x426c0f
mov eax, dword [esp + 0x318]
test eax, eax
je 0x426c0f
mov ecx, 0x46c494
test ecx, ecx
je 0x426c0f
cmp word [0x46c494], 0
je 0x426c0f
push 0x46f8f0
call fcn.00423910
add esp, 4
test eax, eax
je 0x426c0f
fld qword [eax + 0x598]
fcomp qword [0x46f930]
fnstsw ax
test ah, 0x40
jne 0x426c0f
mov edx, dword [0x46f934]
mov eax, dword [0x46f930]
push edx
push eax
call fcn.00439170
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
fstp qword [esp]
push 0x46f8f0
push 0x46c494
lea ecx, [esp + 0x118]
push str._s_s_v_.0f.bk
push ecx
call ebx
add esp, 0x18
lea edx, [esp + 0x108]
push 0
push edx
push 0x46ac34
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [0x69b598]
test eax, eax
je 0x426cf0
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov al, byte [0x46fbc8]
pop edi
test al, 4
jne 0x426c5f
fld qword [0x46fe60]
fcomp qword [0x44e440]
fnstsw ax
test ah, 0x41
jne 0x426c5f
lea eax, [esp + 8]
push str.xInoc
push eax
call ebx
add esp, 8
test byte [0x46fbc8], 8
jne 0x426cc5
fld qword [0x46fd38]
fmul qword [0x46fd30]
fcomp qword [0x44e440]
fnstsw ax
test ah, 0x41
je 0x426c9a
fld qword [0x46fd48]
fmul qword [0x46fd40]
fcomp qword [0x44e440]
fnstsw ax
test ah, 0x41
jne 0x426cc5
mov cx, word [esp + 8]
lea edx, [esp + 8]
neg cx
sbb ecx, ecx
lea eax, [esp + 8]
and ecx, 0x1b
add ecx, 0x20
and ecx, 0xffff
push ecx
push edx
push str._s_cxFsmMg_xFsmRE
push eax
call ebx
add esp, 0x10
mov dx, word [esp + 8]
push 0
neg dx
sbb edx, edx
push 0
lea ecx, [esp + 0x10]
and edx, 0xfffffff9
push 0
push ecx
add edx, 7
push 0xffffffffffffffff
push edx
push 0x238
call fcn.00426440
add esp, 0x1c
mov eax, esi
pop esi
pop ebx
add esp, 0x308
ret
Function at 0x431120
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.0044cc00
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bx
rep stosd dword es:[edi], eax
push 3
push 0x453ebc
push 0x4772a8
mov dword [esp + 0x18], ebx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
mov eax, dword [0x694c18]
jne 0x431184
cmp eax, ebx
jne 0x431184
call fcn.00431260
mov eax, dword [0x694c18]
cmp eax, ebx
jne 0x4311aa
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
cmp word [0x4772a8], bx
jne 0x431173
cmp eax, ebx
je 0x431177
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x694c18], ebx
pop esi
xor eax, eax
pop ebx
add esp, 0x1004
ret
mov esi, dword [esp + 0x1018]
mov edx, dword [esp + 0x1014]
lea ecx, [esp + 0xc]
push ebx
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43121a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x14]
push str.Error_Write_ARS:_lu
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
push ebx
lea ecx, [esp + 0x20]
push ebx
push ecx
push ebx
push 0xffffffffffffffff
push ebx
push 0x251
call fcn.00426440
mov edx, dword [0x694c18]
add esp, 0x28
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [0x694c18], ebx
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 7
push 0x251
call fcn.00426440
mov eax, dword [esp + 0x28]
add esp, 0x1c
cmp eax, esi
je 0x43124a
mov eax, dword [0x694cac]
push 0x45aaf8
push eax
call fcn.00437650
add esp, 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x435470
Capabilities:
Delete file

Disassembly:
mov eax, 0x1000
call fcn.0044cc00
push ebx
push esi
push edi
push 0x453228
push 0x46b864
xor ebx, ebx
call fcn.0043a600
mov edi, eax
add esp, 8
test edi, edi
jne 0x4354d9
push 0x46b864
call fcn.00439b70
lea eax, [esp + 0x10]
push 0x46b864
push eax
call fcn.00439960
add esp, 0xc
cmp word [esp + 0xc], di
je 0x4354d9
push 0x46b864
call dword [sym.imp.MSVCRT.dll__wremove]
push 0x453228
push 0x46b864
call fcn.0043a600
add esp, 0xc
mov edi, eax
mov eax, dword [0x458724]
test eax, eax
jne 0x435500
push 0x46b65c
call fcn.00439b70
push 0x453228
push 0x46b65c
call fcn.0043a600
add esp, 0xc
mov ebx, eax
push ebp
push 0x4531e4
push 0x46bc74
call fcn.0043a600
mov esi, eax
add esp, 8
test esi, esi
jne 0x435551
push 0x46bc74
call fcn.00439b70
push 0x46bc74
push esi
call fcn.00439960
push 0x46bc74
call dword [sym.imp.MSVCRT.dll__wremove]
push 0x4531e4
push 0x46bc74
call fcn.0043a600
mov esi, eax
add esp, 0x18
test esi, esi
je 0x435599
mov ebp, dword [sym.imp.MSVCRT.dll_fputws]
test edi, edi
jne 0x43555f
test ebx, ebx
je 0x4355c8
push esi
lea ecx, [esp + 0x14]
push 0x800
push ecx
call dword [sym.imp.MSVCRT.dll_fgetws]
add esp, 0xc
test eax, eax
je 0x4355c8
test edi, edi
je 0x435586
lea edx, [esp + 0x10]
push edi
push edx
call ebp
add esp, 8
test ebx, ebx
je 0x435595
lea eax, [esp + 0x10]
push ebx
push eax
call ebp
add esp, 8
test esi, esi
jne 0x435557
push 0
push 0
push str.Append_to_MainDB
push 0
push 0xffffffffffffffff
push 0
push 0x221
call fcn.00426440
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
test edi, edi
pop ebp
je 0x4355da
push edi
call esi
add esp, 4
jmp 0x4355f6
test esi, esi
je 0x435599
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
add esp, 4
jmp 0x4355bb
push 0
push 0
push str.Append_LiveDB
push 0
push 0xffffffffffffffff
push 0
push 0x223
call fcn.00426440
add esp, 0x1c
test ebx, ebx
je 0x435600
push ebx
call esi
add esp, 4
push 0x46bc74
call dword [sym.imp.MSVCRT.dll__wremove]
add esp, 4
test eax, eax
pop edi
pop esi
pop ebx
je 0x435631
push 0
push 0
push str.Cannot_delete_old_LiveDB
push 0
push 0xffffffffffffffff
push 0
push 0x222
call fcn.00426440
add esp, 0x1c
add esp, 0x1000
ret
Function at 0x4373e0
Capabilities:
Create thread

Disassembly:
sub esp, 0x230
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0xa
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0x64
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x244]
mov dword [0x6aa950], eax
add eax, 0x4ab0
cmp eax, ebx
je 0x437449
cmp word [eax], bx
je 0x437449
push eax
push 0x6aa958
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
je 0x437470
call fcn.004375f0
test eax, eax
jne 0x43747c
push ebx
push ebx
push str.Cannot_close_UPS_com_port_
push ebx
push 0xffffffffffffffff
push ebx
push 0x256
call fcn.00426440
add esp, 0x1c
mov dword [0x6aa954], ebx
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x230
ret
mov ecx, dword [0x6aa950]
lea eax, [ecx + 0x4ab0]
cmp eax, ebx
je 0x4375d2
cmp word [eax], bx
je 0x4375d2
mov edi, dword [sym.imp.MSVCRT.dll_swprintf]
push eax
lea edx, [esp + 0x40]
push str.._s
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x3c]
push ebx
push 0x40000000
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43758a
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x1c
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov edx, dword [0x6aa950]
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
and edi, 0xfffffffd
mov eax, dword [edx + 0x4af0]
push ecx
push esi
mov dword [esp + 0x18], eax
mov byte [esp + 0x26], 8
mov dword [esp + 0x1c], edi
mov byte [esp + 0x2d], 0xd
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
call dword [sym.imp.KERNEL32.dll_SetCommState]
lea edx, [esp + 0x28]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0xc
push esi
mov dword [0x6aa954], esi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push 0x436ed0
mov dword [0x6aa948], eax
call dword [sym.imp.MSVCRT.dll__beginthread]
mov edx, dword [0x6aa950]
xor ecx, ecx
cmp eax, 0xffffffff
push 0x20
setne cl
add edx, 0x4ab0
mov esi, ecx
push edx
push 0x6aa958
call fcn.00438940
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x230
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x6aa950]
add eax, 0x4ab0
lea ecx, [esp + 0x40]
push eax
push str.Cannot_open_port__s_error__u
push ecx
call edi
push ebx
lea edx, [esp + 0x50]
push ebx
push edx
push ebx
push 0xffffffffffffffff
push ebx
push 0x256
call fcn.00426440
add esp, 0x2c
mov dword [0x6aa954], ebx
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x230
ret
pop edi
mov word [0x6aa958], bx
pop esi
mov eax, 1
pop ebx
add esp, 0x230
ret
Function at 0x438250
Capabilities:
Create directory

Disassembly:
sub esp, 0xa04
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x416]
mov word [esp + 0x414], bp
mov word [esp + 0x614], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x616]
mov word [esp + 0x214], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x14], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x814], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x816]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0xa18]
xor ebx, ebx
cmp eax, ebp
mov dword [esp + 0x10], esi
je 0x438435
cmp word [eax], bp
je 0x438435
push ebp
lea ecx, [esp + 0x418]
push ebp
lea edx, [esp + 0x61c]
push ecx
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wsplitpath]
mov ax, word [esp + 0x428]
add esp, 0x14
cmp ax, 0x5c
jne 0x438333
cmp word [esp + 0x416], ax
jne 0x43833c
mov ebx, 1
jmp 0x43833c
cmp ax, bp
je 0x438435
cmp word [esp + 0x614], bp
je 0x438435
mov esi, dword [sym.imp.MSVCRT.dll_swprintf]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [esp + 0x414]
push 0x458a84
push eax
call dword [sym.imp.MSVCRT.dll_wcstok]
add esp, 8
cmp eax, ebp
je 0x438442
push eax
lea eax, [esp + 0x218]
push 0x45baec
push eax
call edi
add esp, 4
lea ecx, [esp + eax*2 + 0x21c]
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x214]
lea eax, [esp + 0x614]
lea ecx, [esp + 0x14]
push edx
push eax
push 0x45821c
push ecx
call edi
add esp, 4
lea edx, [esp + eax*2 + 0x20]
push edx
call esi
add esp, 0x10
cmp ebx, ebp
je 0x4383ff
lea eax, [esp + 0x214]
lea ecx, [esp + 0x814]
push eax
push ecx
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x81c]
lea eax, [esp + 0x21c]
push edx
push 0x45baec
push eax
call esi
add esp, 0x14
xor eax, eax
mov word [esp + 0x14], bp
jmp 0x43835d
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
je 0x438429
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.MSVCRT.dll__wmkdir]
add esp, 4
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
xor eax, eax
mov word [esp + 0x14], bp
jmp 0x43835d
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa04
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa04
ret
Function at 0x439960
Capabilities:
Copy file

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
test esi, esi
push edi
jne 0x439979
lea esi, [esp + 0x10]
mov edi, dword [esp + 0x220]
mov word [esi], 0
test edi, edi
je 0x4399f8
cmp word [edi], 0
je 0x4399f8
mov ebp, dword [sym.imp.MSVCRT.dll_swprintf]
mov ebx, 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [esi + eax*2 - 2]
add esp, 0xc
cmp eax, esi
jbe 0x4399d1
mov cx, word [eax]
cmp cx, 0x5c
je 0x4399d1
cmp cx, 0x2e
je 0x4399cc
sub eax, 2
cmp eax, esi
ja 0x4399b4
jmp 0x4399d1
mov word [eax], 0
push ebx
push esi
push str._s._03d
push esi
call ebp
add esp, 0x10
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439a05
inc ebx
cmp ebx, 0x3e8
jl 0x43999a
mov word [esi], ax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x439b70
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x214]
test esi, esi
push edi
je 0x439cc4
cmp word [esi], 0
je 0x439cc4
mov edi, dword [sym.imp.MSVCRT.dll__waccess]
push 0
push esi
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x439bb2
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 8]
test eax, eax
je 0x439bd5
mov word [eax], 0
lea edx, [esp + 0xc]
push 0
push edx
call edi
add esp, 8
cmp eax, 0xffffffff
jne 0x439ba4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x10]
push 0
push eax
call ebx
test eax, eax
jne 0x439ca9
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [esp + eax*2 + 0x12]
add esp, 4
mov eax, esi
jmp 0x439c18
mov eax, dword [esp + 0xc]
sub eax, 2
lea edx, [esp + 0x10]
cmp eax, edx
mov dword [esp + 0xc], eax
jbe 0x439c3c
cmp word [eax], 0x5c
je 0x439c3c
sub eax, 2
lea ecx, [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0xc], eax
ja 0x439c27
mov word [eax], 0
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
cmp eax, edx
jbe 0x439ca9
lea eax, [esp + 0x10]
push 0
push eax
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x439c14
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
cmp eax, ecx
jbe 0x439ca9
sub eax, 2
jmp 0x439c73
mov eax, dword [esp + 0xc]
add eax, 2
cmp eax, esi
mov dword [esp + 0xc], eax
jae 0x439c8f
cmp word [eax], 0
je 0x439c8f
add eax, 2
cmp eax, esi
mov dword [esp + 0xc], eax
jb 0x439c7e
mov word [eax], 0x5c
mov eax, dword [esp + 0xc]
cmp eax, esi
jae 0x439ca9
lea edx, [esp + 0x10]
push 0
push edx
call ebx
test eax, eax
jne 0x439c6f
lea eax, [esp + 0x10]
push 0
push eax
call edi
add esp, 8
neg eax
sbb eax, eax
pop ebx
pop edi
inc eax
pop esi
add esp, 0x20c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret
Function at 0x43a600
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
test esi, esi
je 0x43a6b1
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 1
jb 0x43a6b1
push ebx
push esi
call dword [sym.imp.MSVCRT.dll__waccess]
add esp, 8
test eax, eax
jne 0x43a637
mov ebx, 1
push edi
mov edi, dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x43a6ab
mov ax, word [edi]
cmp ax, 0x72
jne 0x43a68c
push esi
push 1
lea eax, [esp + 0x18]
push 2
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp ax, 0xfeff
je 0x43a6ab
push esi
push eax
call dword [sym.imp.MSVCRT.dll_ungetwc]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
cmp ax, 0x77
je 0x43a69c
cmp ax, 0x61
jne 0x43a6ab
test ebx, ebx
jne 0x43a6ab
push esi
push 0xfeff
call dword [sym.imp.MSVCRT.dll_fputwc]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret

Function at 0x43a6c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
push ebx
push esi
push 0x4531e4
push eax
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x43a748
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x14]
push 2
push ecx
mov dword [esp + 0x1c], ebx
call edi
add esp, 0x10
cmp word [esp + 0xc], 0xfeff
je 0x43a72d
push esi
push 1
lea edx, [esp + 0x18]
push 0x100
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x10]
push ebx
push 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x43a732
mov ebx, 1
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x104
ret