joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10de058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010de1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10de07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10de06a
add dl, dl
jne 0x10de089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10de0dc
xor eax, eax
add dl, dl
jne 0x10de096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10de17d
add dl, dl
jne 0x10de0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10de0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10de0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10de0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10de0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10de075
mov eax, 1
add dl, dl
jne 0x10de0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10de0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10de0e1
sub eax, ebx
mov ebx, 1
jne 0x10de128
mov ecx, 1
add dl, dl
jne 0x10de10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10de119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10de105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10de075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10de13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10de14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10de136
cmp eax, 0x7d00
jae 0x10de16d
cmp eax, 0x500
jb 0x10de168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10de075
cmp eax, 0x7f
ja 0x10de170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10de075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10de19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10de075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41f67c
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
mov eax, ecx
push ebx
push esi
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
xor edi, edi
push edi
push 0x407244
push dword [eax + 8]
mov dword [ebp - 4], edi
call fcn.004314b7
mov ebx, dword [ebp - 8]
mov esi, eax
test esi, esi
js 0x41f70a
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.00431799
mov esi, eax
test esi, esi
js 0x41f70a
cmp dword [ebp - 8], edi
je 0x41f710
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push edi
push 0x407244
push dword [eax + 0xc]
call fcn.004314b7
mov esi, eax
test esi, esi
jns 0x41f6eb
push esi
call fcn.004321e3
mov edi, dword [ebp - 4]
jmp 0x41f710
mov edi, dword [ebp - 4]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41f710
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov esi, eax
push esi
call fcn.004321e3
push esi
call fcn.00432150
test edi, edi
je 0x41f720
push edi
call fcn.0043220c
test ebx, ebx
je 0x41f72a
push ebx
call fcn.0043220c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421d70
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x48ec38]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov dword [eax], edi
mov esi, 0x104
mov dword [eax + 4], edi
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.0041a281
push 0x4076e8
push esi
lea eax, [esp + 0x20]
push eax
call fcn.0041a31d
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x421df2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x421e18
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.00420f0f
mov edi, eax
jmp 0x421e18
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.00421c55
mov ebx, eax
test ebx, ebx
jns 0x421e1e
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.00420ec3
mov edi, ebx
test esi, esi
je 0x421e32
jmp 0x421e2c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.00421abb
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d650
mov esp, ebp
pop ebp
ret 8
Function at 0x425d4a
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x48ec38]
xor eax, esp
mov dword [esp + 0x270], eax
or dword [esp + 8], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
test ebx, ebx
jne 0x425da8
mov eax, 0x80070057
push eax
mov ebx, eax
call fcn.004321e3
jmp 0x425f13
test eax, eax
je 0x425d96
push 0x250
push ecx
lea eax, [esp + 0x30]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push 0x407388
push ebx
call fcn.004314b7
mov ebx, eax
test ebx, ebx
js 0x425f09
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a652
mov edi, dword [esp + 0x14]
test edi, edi
je 0x425efb
cmp edi, 0xffffffff
je 0x425efb
mov ecx, 0x407390
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x425e38
test dx, dx
je 0x425e34
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x425e38
add eax, 4
add ecx, 4
test dx, dx
jne 0x425e12
xor eax, eax
jmp 0x425e3d
sbb eax, eax
or eax, 1
test eax, eax
je 0x425ec0
mov ecx, 0x406f00
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x425e70
test dx, dx
je 0x425e6c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x425e70
add eax, 4
add ecx, 4
test dx, dx
jne 0x425e4a
xor eax, eax
jmp 0x425e75
sbb eax, eax
or eax, 1
test eax, eax
je 0x425ec0
test byte [esp + 0x28], 0x10
je 0x425ec0
test esi, esi
je 0x425e8f
push esi
call fcn.0043220c
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00432325
mov ebx, eax
test ebx, ebx
js 0x425eef
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0x20]
call fcn.00434721
mov ebx, eax
test ebx, ebx
js 0x425eef
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x425e09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x425efb
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
call fcn.00431374
jmp 0x425f0f
push ebx
call fcn.004321e3
mov esi, dword [esp + 0x10]
jmp 0x425f0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov ebx, eax
push ebx
call fcn.004321e3
mov edi, dword [esp + 0xc]
push ebx
call fcn.00432150
lea ecx, [esp + 0x14]
call fcn.0043237b
test esi, esi
je 0x425f2c
push esi
call fcn.0043220c
test edi, edi
je 0x425f36
push edi
call fcn.0043220c
push 0
lea ecx, [esp + 0x1c]
call fcn.004347e7
lea ecx, [esp + 0x20]
call fcn.0042e8b9
mov ecx, dword [esp + 0x27c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d650
mov esp, ebp
pop ebp
ret 8
Function at 0x4288be
Capabilities:
Move file

Disassembly:
push 0x1c
mov eax, 0x489998
call fcn.0047dc56
mov eax, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
xor edx, edx
mov edi, edx
mov dword [ebp - 0x10], edi
mov ebx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 2
test ecx, ecx
jne 0x428901
mov eax, 0x80070057
mov esi, eax
push eax
call fcn.004321e3
jmp 0x428a74
test eax, eax
je 0x4288ef
lea ecx, [ebp - 0x18]
push ecx
push edx
xor edx, edx
mov ecx, eax
inc edx
call fcn.0042855d
mov esi, eax
test esi, esi
jns 0x42891d
push esi
jmp 0x4288f7
xor eax, eax
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0x14]
push 0x40a168
push eax
call fcn.0041a772
mov esi, eax
add esp, 0xc
test esi, esi
js 0x428a6b
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp - 0x28]
call fcn.004314b7
mov esi, eax
test esi, esi
js 0x428a60
mov edi, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
mov ecx, edi
call fcn.004317d0
mov esi, eax
test esi, esi
js 0x42891a
cmp dword [ebp - 0x1c], 0
mov eax, dword [0x48ecb8]
je 0x4289ca
test eax, eax
je 0x428981
cmp eax, 0xffffffff
jne 0x428983
xor eax, eax
push edi
push 0x409568
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
test edi, edi
je 0x4289a7
push edi
call fcn.0043220c
xor edi, edi
mov dword [ebp - 0x10], edi
test ebx, ebx
je 0x4289b6
push ebx
call fcn.0043220c
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x2710
jb 0x428922
jmp 0x4289ea
test eax, eax
je 0x4289d3
cmp eax, 0xffffffff
jne 0x4289d5
xor eax, eax
push edi
push 0x4095b8
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
mov eax, dword [0x48ecb8]
test edi, edi
jne 0x428a1c
test eax, eax
je 0x4289fc
cmp eax, 0xffffffff
jne 0x4289fe
xor eax, eax
push 0x409608
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0xc
mov esi, 0x80070003
jmp 0x42891a
test eax, eax
je 0x428a25
cmp eax, 0xffffffff
jne 0x428a27
xor eax, eax
push edi
push dword [ebp - 0x24]
push 0x409650
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x14
push edi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x428a74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov esi, eax
jmp 0x42891a
push esi
call fcn.004321e3
mov edi, dword [ebp - 0x10]
jmp 0x428a74
push esi
call fcn.004321e3
mov ebx, dword [ebp - 0x14]
push esi
call fcn.00432150
cmp dword [ebp - 0x18], 0
je 0x428a89
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x428a93
push ebx
call fcn.0043220c
test edi, edi
je 0x428a9d
push edi
call fcn.0043220c
mov eax, esi
call fcn.0047dc27
ret 8
Function at 0x42e6a1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push esi
push edi
xor edi, edi
push edi
push 0x40ccc4
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, 0x491314
call fcn.0041a7a6
mov eax, dword [0x48ecb8]
test eax, eax
je 0x42e734
cmp eax, 0xffffffff
jne 0x42e736
mov eax, edi
push 0x40cce4
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0xc
mov edx, 0x491330
mov ecx, 0x48ecb8
call fcn.0041b76a
call fcn.0042d247
mov esi, eax
test esi, esi
js 0x42e7a5
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 8]
call fcn.0042d2ee
mov esi, eax
test esi, esi
js 0x42e7a5
cmp dword [esp + 0x40], edi
je 0x42e783
mov esi, 0xc190010a
jmp 0x42e7a5
call fcn.0042e57d
mov esi, eax
cmp esi, 0x80070032
je 0x42e796
test esi, esi
js 0x42e7a5
lea ecx, [esp + 8]
call fcn.0042b159
mov esi, eax
test esi, esi
jns 0x42e7d5
push esi
call fcn.004321e3
mov eax, dword [0x48ecb8]
test eax, eax
je 0x42e7b9
cmp eax, 0xffffffff
jne 0x42e7bb
mov eax, edi
push esi
push 0x40cd00
push 0x406200
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x14
push esi
call fcn.00432150
lea ecx, [esp + 8]
call fcn.0042e7f4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430175
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x260], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x278], edi
mov esi, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x264], eax
test edi, edi
jne 0x4301d5
mov eax, 0x80070057
mov ebx, eax
push eax
jmp 0x430395
call fcn.0043452f
mov ebx, eax
test ebx, ebx
js 0x430394
cmp dword [ebp - 0x268], esi
je 0x4301c8
lea eax, [ebp - 0x264]
push eax
push 0
push 0x409718
push edi
call fcn.004314b7
mov ebx, eax
test ebx, ebx
js 0x430394
push 0x250
lea eax, [ebp - 0x258]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
lea ecx, [ebp - 0x260]
call fcn.0041a652
mov edi, dword [ebp - 0x260]
test edi, edi
je 0x430386
cmp edi, 0xffffffff
je 0x430386
mov ecx, 0x407390
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430287
test dx, dx
je 0x430283
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430287
add eax, 4
add ecx, 4
test dx, dx
jne 0x430261
xor eax, eax
jmp 0x43028c
sbb eax, eax
or eax, 1
test eax, eax
je 0x43032d
mov ecx, 0x406f00
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4302c5
test dx, dx
je 0x4302c1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4302c5
add eax, 4
add ecx, 4
test dx, dx
jne 0x43029f
xor eax, eax
jmp 0x4302ca
sbb eax, eax
or eax, 1
test eax, eax
je 0x43032d
test byte [ebp - 0x258], 0x10
je 0x43032d
test esi, esi
je 0x4302e8
push esi
call fcn.0043220c
and dword [ebp - 0x25c], 0
lea eax, [ebp - 0x25c]
push eax
push 0
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x278]
call fcn.004314b7
mov ebx, eax
test ebx, ebx
js 0x430378
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x270]
lea ecx, [ebp - 0x274]
call fcn.00434721
mov ebx, eax
test ebx, ebx
js 0x430378
mov esi, dword [ebp - 0x25c]
push 0x250
lea eax, [ebp - 0x258]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x430256
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x430386
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x274]
push eax
call fcn.00431374
jmp 0x43039a
push ebx
call fcn.004321e3
mov esi, dword [ebp - 0x25c]
jmp 0x43039a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov ebx, eax
push ebx
call fcn.004321e3
push ebx
call fcn.00432150
lea ecx, [ebp - 0x260]
call fcn.0043237b
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x4303bb
push eax
call fcn.0043220c
test esi, esi
je 0x4303c5
push esi
call fcn.0043220c
push 0
lea ecx, [ebp - 0x274]
call fcn.004347e7
lea ecx, [ebp - 0x26c]
call fcn.0042e8b9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret
Function at 0x4304c2
Capabilities:
Get disk information

Disassembly:
push 0x240
mov eax, 0x48a0e9
call fcn.0047dc8f
mov ecx, edx
mov dword [ebp - 0x248], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov edi, ebx
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 2
mov esi, ebx
test ecx, ecx
jne 0x430535
mov eax, 0x80070057
mov esi, eax
push eax
call fcn.004321e3
jmp 0x4306ba
test eax, eax
je 0x430523
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x430575
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov esi, eax
push esi
jmp 0x43052b
cmp word [ebp - 0x21c], si
lea ebx, [ebp - 0x21c]
jmp 0x430688
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x43059c
cmp eax, 2
jne 0x430665
test edi, edi
je 0x4305ae
push edi
call fcn.0043220c
xor eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
xor eax, eax
push eax
push 0x409e60
push ebx
call fcn.004314b7
mov esi, eax
test esi, esi
js 0x430702
mov edi, dword [ebp - 0x220]
lea edx, [ebp - 0x240]
mov ecx, edi
call fcn.004317d0
mov esi, eax
test esi, esi
js 0x430710
cmp dword [ebp - 0x240], 0
je 0x430665
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, edi
mov ebx, eax
call fcn.0043a1cc
test eax, eax
jne 0x43061b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x43061b
movzx ebx, bx
or ebx, 0x80070000
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x238]
lea ecx, [ebp - 0x23c]
call fcn.00434721
mov esi, eax
test esi, esi
js 0x430702
push ebx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x230]
call fcn.00434f12
mov esi, eax
test esi, esi
js 0x430702
mov edi, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x224]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x244]
jne 0x43066a
sub ecx, edx
xor eax, eax
sar ecx, 1
lea ebx, [ebx + ecx*2]
add ebx, 2
cmp word [ebx], ax
mov dword [ebp - 0x224], ebx
jne 0x430587
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x23c]
push eax
call fcn.00431374
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x230]
push eax
call fcn.00431374
xor ebx, ebx
push esi
call fcn.00432150
test edi, edi
je 0x4306ca
push edi
call fcn.0043220c
push ebx
lea ecx, [ebp - 0x230]
call fcn.00434fb1
lea ecx, [ebp - 0x228]
call fcn.0042e8b9
push ebx
lea ecx, [ebp - 0x23c]
call fcn.004347e7
lea ecx, [ebp - 0x234]
call fcn.0042e8b9
mov eax, esi
call fcn.0047dc41
ret 4
push esi
call fcn.004321e3
mov edi, dword [ebp - 0x220]
jmp 0x4306b8
push esi
call fcn.004321e3
jmp 0x4306b8
Function at 0x430e82
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
xor esi, esi
mov dword [ebp - 0xc], eax
mov ebx, edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push edi
test eax, eax
jne 0x430eb2
mov eax, 0x80070057
mov edi, eax
push eax
call fcn.004321e3
jmp 0x430f43
test ebx, ebx
je 0x430ea0
push esi
call fcn.00432150
push esi
call fcn.00432150
push 0x820
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.0042e8b9
test edi, edi
jne 0x430eee
mov dword [ebp - 4], esi
mov edi, 0x8007000e
push edi
jmp 0x430ea8
push 0x820
push esi
push edi
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x410
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x430f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov edi, eax
jmp 0x430eeb
lea eax, [ebp - 8]
push eax
push edi
call fcn.00432325
mov edi, eax
test edi, edi
jns 0x430f3e
push edi
call fcn.004321e3
mov esi, dword [ebp - 8]
jmp 0x430f43
mov eax, dword [ebp - 8]
mov dword [ebx], eax
push edi
call fcn.00432150
lea ecx, [ebp - 4]
call fcn.0042e8b9
test esi, esi
je 0x430f5b
push esi
call fcn.0043220c
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431408
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
mov esi, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
push edi
mov edi, ecx
test esi, esi
jne 0x431440
mov ebx, 0x80070057
push ebx
call fcn.004321e3
jmp 0x43148b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x431474
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov ebx, eax
jmp 0x431438
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x431464
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
push ebx
call fcn.00432150
cmp dword [ebp - 0x10], 0
je 0x4314a0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret
Function at 0x43157f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x48ec38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x63c]
mov edi, ecx
push eax
push 0x104
push edi
call fcn.0041a469
mov esi, eax
test esi, esi
js 0x431766
push edi
push 0x105
lea eax, [ebp - 0x218]
push eax
call fcn.0041a281
mov esi, eax
test esi, esi
js 0x431766
mov edi, dword [ebp - 0x63c]
mov ecx, 0x80070216
lea eax, [edi - 1]
cmp eax, edi
ja 0x4315e9
mov edi, eax
xor esi, esi
jmp 0x4315f1
push ecx
mov esi, ecx
call fcn.004321e3
push esi
call fcn.00432150
test esi, esi
js 0x431766
add edi, edi
push 0x5c
pop ecx
cmp word [ebp + edi - 0x218], cx
jne 0x431624
cmp edi, 0x20a
jae 0x43178d
xor eax, eax
mov word [ebp + edi - 0x218], ax
xor eax, eax
lea edi, [ebp - 0x218]
and dword [ebp - 0x63c], eax
mov word [ebp - 0x428], ax
cmp word [ebp - 0x218], cx
jne 0x431648
lea edi, [ebp - 0x216]
push ecx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x640], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x431686
push edi
push 0x105
push eax
call fcn.0041a281
mov esi, eax
test esi, esi
js 0x431766
mov dword [ebp - 0x63c], 1
jmp 0x4316cb
sub ebx, edi
sar ebx, 1
push ebx
push edi
push 0x105
push eax
call fcn.0041a2c8
mov esi, eax
test esi, esi
js 0x431766
cmp dword [ebp - 0x640], edi
jb 0x431783
add ebx, ebx
cmp ebx, 0x20a
jae 0x43178d
xor eax, eax
mov word [ebp + ebx - 0x638], ax
mov ebx, dword [ebp - 0x640]
lea eax, [ebp - 0x638]
push eax
push 0x105
lea eax, [ebp - 0x428]
push eax
call fcn.0041a31d
mov esi, eax
test esi, esi
js 0x431766
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4316ff
test al, 0x10
jne 0x431724
push 0
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x431758
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x431758
test ebx, ebx
je 0x431747
push 0x405ff4
push 0x105
lea eax, [ebp - 0x428]
push eax
lea edi, [ebx + 2]
call fcn.0041a31d
mov esi, eax
test esi, esi
js 0x431766
cmp dword [ebp - 0x63c], 0
jne 0x43176c
push 0x5c
pop ecx
jmp 0x431648
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004324dd
mov esi, eax
push esi
call fcn.004321e3
push esi
call fcn.00432150
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d650
leave
ret
mov eax, 0x80070216
mov esi, eax
push eax
jmp 0x431767
call fcn.0047d94e
int3

Function at 0x431799
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4317b4
shr eax, 4
not eax
and eax, 1
jmp 0x4317b6
xor eax, eax
mov dword [esi], eax
push 0
call fcn.00432150
push 0
call fcn.00432150
xor eax, eax
pop esi
ret