joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432368
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0044ccf0
mov eax, dword [ebp + 8]
push eax
call fcn.0043212c
mov edi, eax
pop ecx
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_GetNamedPipeHandleStateW
test eax, eax
je 0x43247a
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b194c
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
xor esi, esi
test byte [ebp - 4], 1
jne 0x4323d6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0
push 0
push edx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
xor ebx, ebx
test esi, esi
je 0x4323e1
call fcn.0043f4dc
mov esi, dword [ebp + 0x10]
sub esi, ebx
cmp esi, 0x1000
jbe 0x4323f3
mov esi, 0x1000
push 0
lea eax, [ebp - 0x14]
push eax
push esi
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push edi
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov esi, ecx
test esi, esi
je 0x432419
add ebx, dword [ebp - 0x14]
jmp 0x432420
test ebx, ebx
jne 0x432420
or ebx, 0xffffffff
push 0
push esi
call fcn.00434534
add esp, 8
test esi, esi
je 0x432464
cmp ebx, dword [ebp + 0x10]
jae 0x432464
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004b196c
add esp, 0xc
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], edx
cmp edx, 0
jne 0x432454
cmp eax, 0
je 0x432464
call fcn.00456f74
test ax, ax
je 0x4323d8
test byte [ebp - 4], 1
jne 0x432489
push 0
lea ecx, [ebp - 4]
push 0
push ecx
push edi
call sub.KERNEL32.DLL_SetNamedPipeHandleState
jmp 0x432489
push 0
push 0
call fcn.00434534
add esp, 8
or ebx, 0xffffffff
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43285c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0044ccf0
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
je 0x43289a
push edi
call fcn.004b19f8
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov ebx, 1
push 0
push ebx
call fcn.00434534
add esp, 8
test esi, esi
je 0x4328b0
push esi
call fcn.0046af54
pop ecx
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4328bc
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push edx
push ecx
push edi
call fcn.004b0368
add esp, 0x10
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push edx
push ecx
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004b0938
add esp, 0x14
call fcn.0044ccf0
push 0x42
mov ecx, dword [ebp + 8]
push ecx
call fcn.004324d8
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne bl
and ebx, 1
test ebx, ebx
je 0x4329d9
test edi, edi
jle 0x432929
cmp dword [ebp + 0x10], 0
jge 0x432934
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x432944
push 0x10
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004c485c
add esp, 0xc
test edi, edi
jle 0x432960
mov cx, word [ebp - 4]
mov word [ebp - 0x3c], cx
mov ax, word [ebp - 8]
mov word [ebp - 0x3a], ax
mov dx, word [ebp - 0xc]
mov word [ebp - 0x36], dx
cmp dword [ebp + 0x10], 0
jl 0x432986
mov cx, word [ebp - 0x10]
mov word [ebp - 0x34], cx
mov ax, word [ebp - 0x14]
mov word [ebp - 0x32], ax
mov dx, word [ebp - 0x18]
mov word [ebp - 0x30], dx
mov cx, word [ebp - 0x1c]
mov word [ebp - 0x2e], cx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
push edx
call sub.KERNEL32.DLL_SystemTimeToFileTime
test eax, eax
je 0x4329c5
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
setne bl
and ebx, 1
jmp 0x4329c7
xor ebx, ebx
push 0
push ebx
call fcn.00434534
add esp, 8
push esi
call fcn.00432598
pop ecx
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4329e8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0044ccf0
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov dword [ebp - 4], eax
test esi, 1
mov edi, eax
je 0x432a13
or ebx, 1
test esi, 2
je 0x432a1e
or ebx, 2
test esi, 4
je 0x432a29
or ebx, 4
test esi, 0x20
je 0x432a34
or ebx, 0x20
test ebx, ebx
jne 0x432a3d
mov ebx, 0x80
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00434534
add esp, 8
test edi, edi
je 0x432a67
push edi
call fcn.0046af54
pop ecx
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432acc
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0044ccf0
test di, di
je 0x432b13
movzx ecx, di
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x432b0f
mov bx, word [ebp - 4]
jmp 0x432b20
xor ebx, ebx
jmp 0x432b20
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x432b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0044ccf0
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x432b71
mov ebx, dword [ebp - 4]
jmp 0x432b73
xor ebx, ebx
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
call fcn.0044ccec
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x432b94
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0044ccf0
test edi, edi
je 0x432be0
push 0
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x432bcb
mov ebx, dword [ebp - 4]
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
jmp 0x432c00
push 0
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00434534
add esp, 8
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0044ccf0
call fcn.004b5ecc
test eax, eax
je 0x432c88
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004c485c
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00434534
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x432d02
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x432ccf
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x432ccf
push 0
push 0
call fcn.00434534
add esp, 8
xor ebx, ebx
jmp 0x432d02
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0044ccf0
call fcn.004b5ecc
test eax, eax
je 0x432d88
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004c485c
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00434534
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x432e02
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x432dcf
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x432dcf
push 0
push 0
call fcn.00434534
add esp, 8
xor ebx, ebx
jmp 0x432e02
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4333ac
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00431fb4
pop ecx
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4333df
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4333df
xor esi, esi
jmp 0x4333e4
mov esi, 1
push 0
push esi
call fcn.00434534
add esp, 8
test esi, esi
je 0x43340e
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
jmp 0x433412
xor eax, eax
xor edx, edx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x433418
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044ccf0
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
test esi, esi
je 0x43345b
push esi
call fcn.0046af54
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x433464
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00433f60
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.0044ccf0
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
test esi, esi
je 0x4334bc
push esi
call fcn.0046af54
pop ecx
test edi, edi
je 0x4334c7
push edi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4334d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044ccf0
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
test esi, esi
je 0x433515
push esi
call fcn.0046af54
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x43351c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044ccf0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push edi
setne al
and eax, 1
mov ebx, eax
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
test esi, esi
je 0x43356f
push esi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433578
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044ccf0
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
test esi, esi
je 0x4335bb
push esi
call fcn.0046af54
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x4335e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x43361f
call fcn.0043388c
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x43361f
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.0043383c
pop ecx
call fcn.0044ccf0
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.0046ae84
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.00434534
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.00478900
add esp, 0xc
push esi
call fcn.0046af54
pop ecx
call fcn.0044ccec
call fcn.004344f8
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x433696
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.0043383c
pop ecx
push edi
call fcn.00434520
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x43371b
cmp byte [ebx], 0
je 0x43371b
push ebx
call fcn.004c4990
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x4336c3
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x5a6417
call fcn.004c493c
add esp, 8
test eax, eax
je 0x4336e0
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x433700
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x5a6417
call fcn.004c493c
add esp, 8
test eax, eax
je 0x433700
dec esi
test esi, esi
je 0x433717
cmp ebx, dword [ebp - 8]
je 0x433717
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004c4810
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x433724
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0044ccf0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.0046ae84
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.00434534
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.00478900
add esp, 0xc
push ebx
call fcn.0046af54
pop ecx
call fcn.0044ccec
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x4337d6
cmp byte [esi], 0
je 0x4337d6
push esi
call fcn.004c4990
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x4337d6
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x5a6417
call fcn.004c493c
add esp, 8
test eax, eax
jne 0x4337d6
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4337e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044ccf0
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00434534
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0044ccec
test esi, esi
je 0x433833
push esi
call fcn.0046af54
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x434630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x434711
test edi, edi
je 0x434711
call fcn.0044ccf0
cmp dword [0x5a6420], 0
jne 0x43467d
push 0x5a6428
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x43467d
push str.CreateSymbolicLinkW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a6420], eax
cmp dword [0x5a6420], 0
je 0x434700
push edi
call fcn.00433f60
pop ecx
mov esi, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00433f60
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4346ac
test al, 0x10
jne 0x4346b0
xor edx, edx
jmp 0x4346b5
mov edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x4346c5
mov ecx, 1
jmp 0x4346c7
xor ecx, ecx
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call dword [0x5a6420]
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00434534
add esp, 8
test esi, esi
je 0x4346f3
push esi
call fcn.0046af54
pop ecx
test edi, edi
je 0x43470a
push edi
call fcn.0046af54
pop ecx
jmp 0x43470a
push 1
call fcn.00434520
pop ecx
xor ebx, ebx
call fcn.0044ccec
jmp 0x43471b
push 2
call fcn.00434520
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x434724
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x43483f
call fcn.0044ccf0
cmp dword [0x5a6424], 0
jne 0x43476b
push 0x5a6428
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x43476b
push str.GetFinalPathNameByHandleW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5a6424], eax
cmp dword [0x5a6424], 0
je 0x434830
push ebx
call fcn.00433f60
pop ecx
mov esi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x434792
test al, 0x10
jne 0x434796
xor edx, edx
jmp 0x43479b
mov edx, 1
mov eax, edx
push 0
test eax, eax
je 0x4347aa
mov ecx, 0x2000010
jmp 0x4347af
mov ecx, 0x80
push ecx
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
jne 0x4347d4
push 0
push 0
call fcn.00434534
add esp, 8
jmp 0x434823
push 0
push 0x108
lea edx, [ebp - 0x210]
push edx
push eax
call dword [0x5a6424]
cmp eax, 0x108
jae 0x43481b
test eax, eax
jbe 0x43480d
mov word [ebp + eax*2 - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call fcn.00478890
pop ecx
mov edi, eax
push 0
push 1
call fcn.00434534
add esp, 8
jmp 0x434823
push 9
call fcn.00434520
pop ecx
test esi, esi
je 0x434838
push esi
call fcn.0046af54
pop ecx
jmp 0x434838
push 1
call fcn.00434520
pop ecx
call fcn.0044ccec
jmp 0x434847
push 2
call fcn.00434520
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434c28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0044ccf0
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x434c55
push ebx
call fcn.00433f60
pop ecx
mov esi, eax
jmp 0x434c57
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x434c78
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x434c78
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00433f60
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x434caf
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x434c9d
push 0
push 0
call fcn.00434534
add esp, 8
xor eax, eax
jmp 0x434d11
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x434cc1
mov ebx, 0x5a64b4
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x434ce9
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.00478900
add esp, 0xc
test esi, esi
je 0x434cf4
push esi
call fcn.0046af54
pop ecx
test edi, edi
je 0x434cff
push edi
call fcn.0046af54
pop ecx
push 0
push ebx
call fcn.00434534
add esp, 8
call fcn.0044ccec
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x434da6
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.00478900
add esp, 0xc
test esi, esi
jne 0x434dcf
cmp byte [ebx], 0
je 0x434dcf
push ebx
call fcn.004c4990
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x434dda
cmp eax, 0x107
jge 0x434dda
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x434dda
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4362d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x4363c9
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x436311
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00470a9c
add esp, 0x10
mov esi, eax
jmp 0x436329
push 0
push 0
call fcn.004784e0
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004709c8
add esp, 0x10
mov esi, eax
test esi, esi
je 0x4363bf
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x436341
mov edx, 2
jmp 0x436346
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x4363c4
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4363b3
cmp dword [ebp + 8], 0xd
jne 0x436381
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00470a9c
add esp, 0x10
jmp 0x436399
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.004784e0
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.004709c8
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x4363c4
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x4363c4
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret