joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430dd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x430fee
mov eax, dword [esi + 0xc]
test eax, eax
je 0x430e0e
sub eax, 1
je 0x430e03
sub eax, 1
jne 0x430e0e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x430e30
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x430e30
mov ebx, dword [esp + 0x34]
jmp 0x430e30
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x430e84
xor edi, edi
test ebx, ebx
jbe 0x430ea9
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x430e54
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x430ea9
add edi, 0x4000
cmp edi, ebx
jb 0x430e44
jmp 0x430ea1
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x430fe8
cmp byte [esi + 0x14], 0
je 0x430fe8
cmp dword [esi + 0xc], 0
jne 0x430fe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00430550
mov ebx, eax
lea eax, [esi + 0x17]
push eax
mov dword [esp + 0x2c], edx
call fcn.00431510
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x430f39
ja 0x430efa
cmp dword [esp + 0x1c], ebp
jbe 0x430f39
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x430f39
jl 0x430f11
cmp edx, 0xffffffff
ja 0x430f39
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x430f39
jg 0x430f24
cmp ecx, 0xffffffff
jbe 0x430f39
lea edx, [esi + 0x418]
push edx
lea eax, [esi + 0x17]
push eax
mov ecx, 0x4d76b4
call fcn.00429220
push 0
lea ebx, [esi + 0x418]
push ebx
lea edi, [esi + 0x17]
push edi
mov ecx, 0x4d76b4
call fcn.004292a0
test al, al
je 0x430fcf
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x430e20
test eax, eax
jbe 0x430e20
mov ecx, esi
call fcn.00430550
mov ecx, dword [esp + 0x10]
xor ebp, ebp
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebp
cmp ecx, 0xffffffff
je 0x430e20
mov ebp, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebp, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x430e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x430e20
cmp byte [esi + 0x14], 0
je 0x430e20
push ebx
push edi
mov ecx, 0x4d76b4
call fcn.00429380
jmp 0x430e20
lea eax, [esi + 0x418]
push eax
lea ecx, [esi + 0x17]
push ecx
push 0
push 0
mov ecx, 0x4d76b4
call fcn.00429750
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x431410
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.00451a40
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x43146c
cmp eax, 5
je 0x43146c
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004a48d3
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.004a48d3
add esp, 0x404
ret 4

Function at 0x431490
Capabilities:
Get disk information

Disassembly:
sub esp, 0x804
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
lea ecx, [esp]
push ecx
push eax
call fcn.00452fa0
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4314ec
cmp eax, 5
je 0x4314ec
xor eax, eax
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004a48d3
add esp, 0x804
ret 4
mov ecx, dword [esp + 0x800]
xor ecx, esp
mov eax, 1
call fcn.004a48d3
add esp, 0x804
ret 4

Function at 0x431510
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00451a40
cmp dword [0x4d5094], 0
jne 0x43156d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x431560
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d5094], eax
cmp dword [0x4d5094], 0
je 0x4315ee
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.00452130
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x4d5094]
test eax, eax
je 0x4315ee
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x4315ee
push 1
push 0
push 0
push eax
call fcn.004a5730
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004a48d3
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x43163b
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004a48d3
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.004a48d3
add esp, 0x42c
ret 4
Function at 0x431660
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00451a40
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43174f
mov ecx, 0x4bbfd4
lea eax, [esp]
jmp 0x4316c0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4316e0
test dl, dl
je 0x4316dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4316e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4316c0
xor eax, eax
jmp 0x4316e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x431733
mov ecx, str.FAT32
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x431711
test dl, dl
je 0x43170d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x431711
add eax, 2
add ecx, 2
test dl, dl
jne 0x4316f1
xor eax, eax
jmp 0x431716
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x431733
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a48d3
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004a48d3
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004a48d3
add esp, 0x50c
ret 4

Function at 0x431770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043ee30
test eax, eax
je 0x43179b
mov eax, dword [esp + 8]
test eax, eax
je 0x43179b
cmp word [eax], 0
je 0x43179b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x4317b7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4317b7
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x4317c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043ee30
test eax, eax
je 0x4317e7
mov eax, dword [esp + 4]
test eax, eax
je 0x4317e7
cmp word [eax], 0
je 0x4317e7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x431850
Capabilities:
Get file attributes

Disassembly:
call fcn.0043ee30
test eax, eax
je 0x431871
mov eax, dword [esp + 8]
test eax, eax
je 0x431871
cmp word [eax], 0
je 0x431871
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x431880
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ee30
test eax, eax
je 0x4318ab
mov eax, dword [esp + 8]
test eax, eax
je 0x4318ab
cmp word [eax], 0
je 0x4318ab
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x4318c7
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x4318d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4318e0
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x4318fa
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.00412750
lea ecx, [esp + 0x10]
call fcn.0046dc80
lea ecx, [esp + 0x10]
call fcn.0046dac0
mov ebp, eax
lea eax, [ebx + esi - 6]
xor edi, edi
mov dword [esp + 0x38], eax
lea ebx, [ebx + esi - 4]
lea eax, [edi + ebp]
cdq
mov ecx, 0xf4240
idiv ecx
push edx
mov edx, dword [esp + 0x3c]
push str._06u
push edx
call fcn.004a48e2
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0043ee30
test esi, esi
je 0x431968
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431968
cmp edi, 0x3e8
je 0x431974
inc edi
jmp 0x431927
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4

Function at 0x431980
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004a5100
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0043ee30
test eax, eax
je 0x431a0f
test esi, esi
je 0x4319cb
cmp word [esi], 0
jne 0x4319d5
test edi, edi
je 0x431a0f
cmp word [edi], 0
je 0x431a0f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.00451ae0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.00451ae0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x431a17
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004a48d3
add esp, 0x1004
ret 0x10

Function at 0x431c80
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
mov ebx, dword [esp + 0xc30]
push edi
mov edi, dword [esp + 0xc30]
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00431bb0
test al, al
je 0x431ce5
call fcn.0043ee30
test eax, eax
je 0x431cde
cmp word [esp + 0x414], 0
je 0x431cde
lea edx, [esp + 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431d08
lea eax, [esp + 8]
push eax
jmp 0x431d02
call fcn.0043ee30
test eax, eax
je 0x431d01
test ebx, ebx
je 0x431d01
cmp word [ebx], 0
je 0x431d01
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x431d08
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc28]
test eax, eax
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.004a48d3
add esp, 0xc24
ret 8
Function at 0x4320a0
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0043ee30
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x4320c8
test esi, esi
je 0x4320c8
cmp word [esi], 0
je 0x4320c8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x4320d5
test edi, edi
je 0x432108
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4320f3
cmp byte [esp + 0x14], 0
je 0x4320ec
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.00431880
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x432108
cmp eax, 3
mov eax, 1
jne 0x43210d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x432120
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x43224d
cmp byte [ebp], 0
je 0x43224d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x4321d0
cmp byte [edi], 0x5c
jne 0x4321b2
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a6230
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.0043ee30
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x4321a7
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.00431880
jmp 0x4321b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x50e1b8], 0
je 0x4321ca
push edi
mov ecx, 0x50e0b8
call fcn.004737b0
mov edi, eax
jmp 0x4321cb
inc edi
cmp byte [edi], 0
jne 0x432160
cmp byte [esp + 0x420], 0
pop esi
jne 0x43222f
push ebp
call fcn.00451c90
movsx eax, byte [eax]
push eax
call fcn.004516a0
test al, al
jne 0x43222f
call fcn.0043ee30
push 0
push ebp
call ebx
test eax, eax
je 0x432224
push 0
push 0
push ebp
call fcn.00431880
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a48d3
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004a48d3
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a48d3
add esp, 0x408
ret 8
Function at 0x432270
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x4323a4
cmp word [ebp], 0
je 0x4323a4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x43231c
cmp word [edi + ebp], 0x5c
jne 0x432312
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004a6d1f
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.0043ee30
test eax, eax
je 0x43230d
cmp word [esp + 0x14], 0
je 0x43230d
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x432307
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.00431880
jmp 0x432312
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x4322b0
cmp byte [esp + 0x820], 0
pop esi
jne 0x432386
push ebp
call fcn.00451620
movzx ecx, word [eax]
push ecx
call fcn.004516a0
test al, al
jne 0x432386
call fcn.0043ee30
test eax, eax
je 0x432381
cmp word [ebp], 0
je 0x432381
push 0
push ebp
call ebx
test eax, eax
je 0x43237b
push 0
push ebp
push 0
call fcn.00431880
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a48d3
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004a48d3
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004a48d3
add esp, 0x808
ret 8
Function at 0x432400
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0043ee30
test eax, eax
je 0x43259e
test esi, esi
je 0x432462
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x432467
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x432475
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x43247a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43248c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x432491
mov byte [esp + 0x13], 0
call fcn.0043ee30
test eax, eax
je 0x4324b1
test edi, edi
je 0x4324b1
cmp word [edi], 0
je 0x4324b1
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x4324bc
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4325b9
test al, 1
je 0x4325b9
push 0
push edi
push ebp
mov bl, 1
call fcn.00431880
push 0x400
lea ecx, [esp + 0x40]
push ecx
push edi
push ebp
call fcn.00451ae0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43259e
cmp byte [esp + 0x12], 0
je 0x432526
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.0046d740
cmp byte [esp + 0x11], 0
je 0x43253b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0046d740
cmp byte [esp + 0x13], 0
je 0x432550
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.0046d740
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x43259e
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.00431880
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a48d3
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x4324d8

Function at 0x4326c0
Capabilities:
Set file attributes

Disassembly:
call fcn.0043ee30
test eax, eax
je 0x4326e9
mov eax, dword [esp + 8]
test eax, eax
je 0x4326e9
cmp word [eax], 0
je 0x4326e9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 4]
test eax, eax
je 0x432703
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x432710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x24
push ebx
push esi
mov esi, dword [esp + 0x30]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432720
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, 6
ja 0x432740
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
push ebp
push edi
lea ecx, [esp + 0x10]
call fcn.00412750
lea ecx, [esp + 0x10]
call fcn.0046dc80
lea ecx, [esp + 0x10]
call fcn.0046dac0
mov ebp, eax
xor edi, edi
xor edx, edx
mov ecx, 0xf4240
lea eax, [edi + ebp]
div ecx
lea eax, [esi + ebx*2 - 0xc]
push edx
push 0x4bc008
push eax
mov edx, 7
call fcn.004a29f0
mov edx, 0x2e
add esp, 0xc
mov word [esi + ebx*2 - 8], dx
call fcn.0043ee30
test eax, eax
je 0x4327be
test esi, esi
je 0x4327be
cmp word [esi], 0
je 0x4327be
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4327be
cmp edi, 0x3e8
je 0x4327ca
inc edi
jmp 0x432761
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret 4
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
Function at 0x4327e0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4b6d76
mov eax, dword fs:[0]
push eax
sub esp, 0xc34
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0xc30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0xc48]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc58]
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
call fcn.00463260
xor ebp, ebp
mov dword [esp + 0xc50], ebp
mov esi, 0x10000
push esi
call fcn.004a49ac
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x432859
mov ecx, 0x4d76b4
call fcn.00429080
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0xc50], 1
mov ecx, edi
xor esi, esi
or ebx, 0xffffffff
call fcn.00430650
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x4e9b84], esi
je 0x4328ae
push 0x200
lea eax, [esp + 0x48]
push eax
call fcn.00485dc0
mov edx, dword [0x4e9b84]
push 0x200
lea ecx, [esp + 0x848]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
mov ecx, edi
call fcn.00430cf0
jmp 0x4328c4
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc5c]
cmp eax, 0x7fffffff
jne 0x4328db
cmp dword [esp + 0xc60], eax
je 0x4328ee
cmp dword [esp + 0xc60], 0
jl 0x4328f3
jg 0x4328ee
cmp eax, 0x10000
jbe 0x4328f3
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, edi
call fcn.00431000
mov edi, eax
test edi, edi
je 0x4329b8
add esi, 1
adc ebp, 0
mov eax, esi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x432979
cmp dword [0x4e9b84], eax
je 0x432974
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push esi
call fcn.004a5730
push edx
push eax
call fcn.0046a1e0
push eax
push 0x51e
call fcn.004611c0
push eax
lea eax, [esp + 0x44c]
push eax
mov edx, 0x200
call fcn.004a29f0
add esp, 0xc
lea ecx, [esp + 0x444]
push ecx
call fcn.00485de0
call fcn.00486470
call fcn.0046b770
mov edx, dword [esp + 0x20]
push edi
push edx
push ebx
call fcn.00420a00
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0xc5c], eax
jne 0x4329a2
cmp dword [esp + 0xc60], eax
je 0x4328c0
mov eax, edi
cdq
sub dword [esp + 0xc5c], eax
sbb dword [esp + 0xc60], edx
jmp 0x4328c0
cmp dword [0x4e9b84], 0
je 0x4329dd
lea eax, [esp + 0x44]
push eax
call fcn.00485de0
lea ecx, [esp + 0x844]
push ecx
call fcn.00485d70
call fcn.00486470
not ebx
mov esi, ebx
mov byte [esp + 0xc50], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4329fa
push eax
call fcn.004a4a6f
add esp, 4
mov dword [esp + 0xc50], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00463290
mov eax, esi
mov ecx, dword [esp + 0xc48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc30]
xor ecx, esp
call fcn.004a48d3
add esp, 0xc40
ret 0x10
Function at 0x432a60
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0xc], eax
jbe 0x432ab8
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret