joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416004
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x444a08
call fcn.00441730
sub esp, 0x15c
push ebx
push esi
mov ebx, ecx
push edi
push 4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
call fcn.00402708
mov esi, 0x44b2d0
mov dword [ebp - 0x2c], esi
and dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x40]
call fcn.00402708
mov dword [ebp - 0x40], esi
push 0
push 2
mov byte [ebp - 4], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x14], edi
je 0x4160b7
mov esi, 0x128
lea eax, [ebp - 0x168]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x168]
mov dword [ebp - 0x168], esi
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
setne al
movzx eax, al
test eax, eax
je 0x4160b7
push dword [ebp - 0x160]
lea ecx, [ebp - 0x2c]
call fcn.004098e2
push dword [ebp - 0x150]
lea ecx, [ebp - 0x40]
call fcn.004098e2
lea eax, [ebp - 0x168]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
jmp 0x416080
cmp edi, 0xffffffff
mov byte [ebp - 4], 1
je 0x4160c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
jle 0x416197
mov ecx, dword [ebp - 0x20]
xor esi, esi
shl eax, 2
mov ecx, dword [eax + ecx]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x34]
add eax, ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x416113
mov edi, dword [ebx + 0xc]
mov ebx, dword [eax]
lea eax, [ecx + esi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [edi + eax*4]
cmp ebx, edx
je 0x41613e
jae 0x416109
mov ecx, eax
jmp 0x41610c
lea esi, [eax + 1]
cmp esi, ecx
jne 0x4160f4
mov ebx, dword [ebp - 0x18]
or eax, 0xffffffff
test eax, eax
jl 0x416167
mov edi, dword [ebx + 8]
xor esi, esi
test edi, edi
je 0x41614a
mov ecx, dword [ebx + 0xc]
lea eax, [edi + esi]
cdq
sub eax, edx
sar eax, 1
lea ecx, [ecx + eax*4]
mov ecx, dword [ecx]
cmp dword [ebp - 0x10], ecx
je 0x41614d
jae 0x416143
mov edi, eax
jmp 0x416146
mov ebx, dword [ebp - 0x18]
jmp 0x416116
lea esi, [eax + 1]
cmp esi, edi
jne 0x416123
or eax, 0xffffffff
test eax, eax
jge 0x416167
push dword [ebp - 0x10]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x416179
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
jl 0x4160d5
jmp 0x416197
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00416250
push esi
lea ecx, [ebx + 0x14]
call fcn.004098e2
push 1
lea ecx, [ebx + 0x28]
call fcn.004161e4
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
jne 0x4160c7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00428448
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00428448
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41ad0a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x445286
call fcn.00441730
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x44a580
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403337
lea ecx, [esi + 0x18]
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403337
lea ecx, [esi + 0x24]
push 3
mov byte [ebp - 4], 2
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403337
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 4
mov dword [esi + 0x30], 0x44a538
mov dword [esi], 0x44b2fc
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41ad98
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4452c1
call fcn.00441730
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x44a538
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00428471
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00428448
push dword [esi + 0x24]
call fcn.00428622
push dword [esi + 0x18]
call fcn.00428622
push dword [esi + 0xc]
call fcn.00428622
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x44a5b0
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret

Function at 0x41ca73
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4455b7
call fcn.00441730
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x44a580
lea ecx, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403337
lea ecx, [esi + 0x1c]
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403337
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], 8
mov dword [esi + 0x28], 0x44b35c
mov dword [esi], 0x44b32c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41ec08
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x445b6c
call fcn.00441730
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.0041eb90
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.004030cd
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00428622
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.0041ebe0
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.004030cd
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00428622
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.0041ebb8
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.004030cd
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.00428622
pop ecx
push dword [0x45ae48]
lea ecx, [esi + 0x30]
call fcn.0040306e
push 0x11
pop ecx
call fcn.0041f86c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41f86c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x41f8d6
push 0x4008
lea eax, [ebp - 0x168]
push 0x160
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x41f8ce
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x164]
leave
ret
xor eax, eax
leave
ret

Function at 0x41f8fc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
cmp byte [0x45c45c], 0
push esi
mov esi, edx
jne 0x41f956
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.004283ee
mov eax, dword [eax]
lea ecx, [ebp - 0x16c]
push 0x4010
push 0x160
or esi, 0x80
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00428622
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, esi
jmp 0x41f97c
push 0x4010
lea eax, [ebp - 0x2c0]
mov edx, esi
push 0x2b4
push eax
or dl, 0x80
call fcn.0041f981
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x2bc]
mov dword [ecx], edx
pop esi
leave
ret 4
Function at 0x41f99d
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x445d14
call fcn.00441730
sub esp, 0x42c
cmp byte [0x45c45c], 0
push esi
mov esi, edx
jne 0x41fa38
and byte [ebp - 0x74], 0
mov edx, ecx
lea ecx, [ebp - 0x18]
call fcn.0043a509
mov eax, dword [eax]
lea ecx, [ebp - 0x184]
push 0x4410
push 0x160
or esi, 0x80
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, eax
push dword [ebp - 0x18]
call fcn.00428622
pop ecx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404668
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00403dd1
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.004030cd
push dword [ebp - 0x24]
call fcn.00428622
push dword [ebp - 0x18]
call fcn.00428622
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x180]
jmp 0x41fa77
mov ecx, dword [ecx]
and word [ebp - 0x224], 0
push 0x4410
lea eax, [ebp - 0x438]
mov edx, esi
push 0x2b4
push eax
or dl, 0x80
call fcn.0041f981
mov ecx, dword [ebp + 0xc]
mov esi, eax
lea eax, [ebp - 0x224]
push eax
call fcn.0040306e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x434]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x423045
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
mov eax, 0x4463b6
call fcn.00441730
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 3
xor ebx, ebx
or eax, 0xffffffff
lea ecx, [esi + 0x38]
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
push edi
mov dword [ebp - 0x10], esi
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
lea ecx, [esi + 0x44]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], 4
mov dword [esi + 0x50], 0x44a538
lea ecx, [esi + 0x64]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
lea ecx, [esi + 0x7c]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
lea ecx, [esi + 0x88]
push edi
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403337
lea ecx, [esi + 0x94]
call fcn.004414c0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x425ae9
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x446770
call fcn.00441730
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov ebx, ecx
cmp dword [esi + 4], edi
jne 0x425b0d
or eax, 0xffffffff
jmp 0x425bd3
cmp dword [ebp + 0xc], 0xffffffff
jne 0x425b16
mov dword [ebp + 0xc], edi
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.00403337
mov eax, 0x10f
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], eax
jg 0x425b3f
push eax
lea ecx, [ebp - 0x20]
call fcn.00403337
mov eax, dword [esi]
mov esi, 0x10e
push esi
push dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x14], eax
cmp word [edx], di
je 0x425b68
mov eax, edx
inc ecx
inc eax
inc eax
cmp word [eax], di
jne 0x425b60
cmp dword [ebp - 0x14], edi
mov word [edx + ecx*2], di
mov dword [ebp - 0x1c], ecx
je 0x425b79
cmp dword [ebp - 0x14], esi
jb 0x425b84
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004030cd
lea eax, [ebp - 0x10]
push 1
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp eax, 1
jne 0x425bc5
cmp dword [ebp - 0x10], edi
je 0x425bc5
push dword [ebp - 0x10]
push 0xffffffffffffffff
push dword [ebx + 0x48]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebx + 0x44]
mov esi, eax
lea ecx, [eax + 1]
mov dword [ebx + 0x44], ecx
jmp 0x425bc8
or esi, 0xffffffff
push dword [ebp - 0x20]
call fcn.00428622
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4265dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov edi, ecx
push 0x11
call esi
mov bx, ax
push 0x12
shr ebx, 0xf
and bl, 1
call esi
shr eax, 0xf
test al, 1
jne 0x426679
mov eax, dword [ebp + 8]
test bl, bl
mov cx, word [eax + 0xc]
je 0x426654
cmp cx, 0x41
je 0x42665a
movzx eax, cx
cmp eax, 0x20
je 0x42663b
cmp eax, 0x6a
jle 0x426679
cmp eax, 0x6d
jle 0x42663b
cmp eax, 0x6f
je 0x42663b
cmp eax, 0xbb
je 0x42663b
cmp eax, 0xbd
jne 0x426679
test bl, bl
jne 0x426679
xor eax, eax
cmp cx, 0x20
setne al
push eax
mov ecx, edi
call fcn.00426537
mov al, 1
jmp 0x42667b
cmp cx, 0x6a
jne 0x426616
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [edi + 0x4c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x426650
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42736d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x446a2a
call fcn.00441730
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040302b
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040302b
mov al, byte [edi + 0x18]
lea ecx, [esi + 0x38]
mov byte [esi + 0x18], al
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.0040302b
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.0040302b
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x429191
Capabilities:
Write clipboard data

Disassembly:
mov eax, 0x446ce4
call fcn.00441730
push ecx
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x2002
call fcn.0042ba4f
test al, al
jne 0x4291c3
xor bl, bl
jmp 0x4291f9
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4291bf
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4291bf
and dword [ebp - 0x10], 0
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042ba70
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x429a6c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x446df0
call fcn.00441730
sub esp, 0x32c
cmp byte [0x45c45c], 0
push esi
push edi
mov edi, ecx
jne 0x429ae2
and byte [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404668
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00428433
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004030cd
push dword [ebp - 0x24]
call fcn.00428622
push dword [ebp - 0x18]
call fcn.00428622
pop ecx
pop ecx
jmp 0x429b0c
and word [ebp - 0x338], 0
lea eax, [ebp - 0x338]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, edi
call fcn.0040306e
test esi, esi
jbe 0x429b1d
cmp esi, 0x104
ja 0x429b1d
push 1
pop eax
jmp 0x429b1f
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x429c5e
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x446e18
call fcn.00441730
sub esp, 0x18
cmp byte [0x45c45c], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x429ca0
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.004283ee
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
push dword [ebp - 0x24]
call fcn.00428622
test esi, esi
pop ecx
je 0x429cfa
jmp 0x429cae
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call esi
test eax, eax
je 0x429cb2
mov al, 1
jmp 0x429cfc
xor eax, eax
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.00403337
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
mov ecx, ebx
call fcn.0042b51c
test al, al
je 0x429cf1
push edi
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00428622
test esi, esi
pop ecx
setne al
jmp 0x429cfc
push dword [ebp - 0x18]
call fcn.00428622
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x429d0b
Capabilities:
Delete directory

Disassembly:
mov eax, 0x446e2c
call fcn.00441730
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45c45c], bl
push esi
push edi
mov edi, ecx
jne 0x429d4a
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.004283ee
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
push dword [ebp - 0x24]
call fcn.00428622
cmp esi, ebx
pop ecx
je 0x429d9c
jmp 0x429d57
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call esi
test eax, eax
je 0x429d5b
mov al, 1
jmp 0x429d9e
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403337
lea edx, [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042b51c
test al, al
push dword [ebp - 0x18]
je 0x429d96
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00428622
cmp esi, ebx
pop ecx
setne al
jmp 0x429d9e
call fcn.00428622
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x429dad
Capabilities:
Move file

Disassembly:
mov eax, 0x446e50
call fcn.00441730
sub esp, 0x34
push ebx
xor ebx, ebx
cmp byte [0x45c45c], bl
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
jne 0x429e0c
lea ecx, [ebp - 0x40]
call fcn.004283ee
mov edx, dword [ebp - 0x10]
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.004283ee
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
push dword [ebp - 0x34]
call fcn.00428622
push dword [ebp - 0x40]
call fcn.00428622
pop ecx
cmp esi, ebx
pop ecx
je 0x429e97
jmp 0x429e1a
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
push ecx
call esi
test eax, eax
je 0x429e1e
mov al, 1
jmp 0x429e99
push 3
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.00403337
push 3
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00403337
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
mov edx, edi
mov byte [ebp - 4], 2
call fcn.00429bfe
test al, al
push dword [ebp - 0x1c]
je 0x429e88
push dword [ebp - 0x28]
call esi
mov esi, eax
push dword [ebp - 0x1c]
call fcn.00428622
push dword [ebp - 0x28]
call fcn.00428622
pop ecx
cmp esi, ebx
pop ecx
setne al
jmp 0x429e99
call fcn.00428622
push dword [ebp - 0x28]
call fcn.00428622
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x429ea8
Capabilities:
Create directory

Disassembly:
mov eax, 0x446e64
call fcn.00441730
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45c45c], bl
push esi
push edi
mov edi, ecx
jne 0x429ee9
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.004283ee
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
push dword [ebp - 0x24]
call fcn.00428622
cmp esi, ebx
pop ecx
je 0x429f4d
jmp 0x429ef7
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push edi
call esi
test eax, eax
je 0x429efb
mov al, 1
jmp 0x429f4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x429f4d
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403337
lea edx, [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042b51c
test al, al
je 0x429f44
push ebx
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00428622
cmp esi, ebx
pop ecx
setne al
jmp 0x429f4f
push dword [ebp - 0x18]
call fcn.00428622
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42a73a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x446f98
call fcn.00441730
sub esp, 0x32c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x45c45c], bl
jne 0x42a7b8
lea eax, [ebp - 0x12c]
mov byte [ebp - 0x12c], bl
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404668
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.00428433
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004030cd
push dword [ebp - 0x24]
call fcn.00428622
push dword [ebp - 0x18]
call fcn.00428622
pop ecx
pop ecx
jmp 0x42a7e1
lea eax, [ebp - 0x338]
mov word [ebp - 0x338], bx
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.0040306e
cmp edi, ebx
jbe 0x42a7f2
cmp edi, 0x104
ja 0x42a7f2
push 1
pop eax
jmp 0x42a7f4
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret