joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
cmp ebx, edi
je 0x41f196
mov ecx, dword [ebp + 8]
cmp ecx, edi
jl 0x41f196
mov eax, dword [esi + 0x32690]
cmp ecx, eax
jg 0x41f196
mov byte [ebp - 1], 0
mov dword [ebp - 8], edi
cmp eax, edi
jle 0x41f196
jmp 0x41f043
mov ecx, dword [ebp + 8]
cmp edi, 5
ja case.default.0x41f048
jmp dword [edi*4 + 0x41f1a0]
mov al, byte [ebx]
mov byte [ebp - 1], al
jmp case.default.0x41f048
mov dl, byte [ebx + 1]
jmp 0x41f073
mov al, byte [ebx + 2]
mov byte [ebp - 1], al
jmp case.default.0x41f048
mov dl, byte [ebx + 3]
jmp 0x41f073
mov al, byte [ebx + 4]
mov byte [ebp - 1], al
jmp case.default.0x41f048
mov dl, byte [ebx + 5]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x41f131
mov eax, dword [esi + ecx*4 + 0x33b48]
imul eax, dword [ebp - 8]
mov edx, dword [esi + 0x33b7c]
add eax, dword [esi + ecx*4 + 0x33b60]
lea ebx, [edi + 0x12e]
imul ebx, ebx, 0x2ac
push 0
push edx
add ebx, esi
push eax
mov ecx, ebx
call fcn.0051c2b0
mov edx, dword [esi + 0x33b98]
mov eax, dword [ebp + 8]
push 0
push edx
mov edx, dword [esi + eax*4 + 0x33b48]
imul edx, dword [ebp - 8]
add edx, dword [esi + eax*4 + 0x33b7c]
lea ecx, [edi + edi*8 + 0x336f]
shl ecx, 4
add ecx, esi
push edx
mov dword [ebp - 0xc], ecx
call fcn.0051c2b0
mov eax, dword [ebx + 4]
test eax, eax
je 0x41f0f6
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f102
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
test eax, eax
je 0x41f11d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
jmp 0x41f189
mov edx, dword [ecx]
mov eax, dword [edx + 4]
inc dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax], 6
jmp 0x41f189
lea eax, [edi + 0x12e]
imul eax, eax, 0x2ac
mov ecx, dword [eax + esi + 4]
add eax, esi
test ecx, ecx
je 0x41f152
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f15e
mov edx, dword [eax]
mov ecx, dword [edx + 4]
mov dword [eax + ecx], 6
lea eax, [edi + edi*8 + 0x336f]
shl eax, 4
mov ecx, dword [eax + esi + 4]
add eax, esi
test ecx, ecx
je 0x41f17d
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41f189
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [eax + edx], 6
inc edi
cmp edi, dword [esi + 0x32690]
jl 0x41f040
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x42cea0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b888
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x74]
push esi
or edi, 0xffffffff
call fcn.00440900
test al, al
je 0x42ceff
xor eax, eax
cmp dword [esi + 0x68], eax
jle 0x42cefd
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x42ceea
mov eax, 0x54ee24
push eax
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov dword [ebx], edi
call fcn.00440640
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00508010
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42cf34
push eax
call fcn.0051eadb
add esp, 4
cmp dword [ebx], 0
jl 0x42cf54
cmp dword [esi + 4], 0
jle 0x42cf54
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42cf70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c17b
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [ecx + 0x74]
mov dword [ebp - 4], ebx
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], esi
call fcn.00440900
cmp al, bl
je 0x42d14e
xor eax, eax
cmp dword [esi + 0x68], ebx
jle 0x42cfec
mov esi, dword [esi + 0x64]
cmp esi, ebx
jne 0x42cfd9
mov esi, 0x54ee24
push esi
push 0xffffffffffffffff
push str.DataFolderCsidl
push str.CcDataFolderDefault
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jl 0x42d14e
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x54], ebx
mov ecx, eax
lea esi, [ebp - 0x20]
lea ebx, [ebp - 0x54]
mov dword [ebp - 4], 1
call fcn.00508530
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00508010
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42d045
push eax
call fcn.0051eadb
add esp, 4
cmp dword [edi + 4], 0
jle 0x42d141
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.00440640
mov bl, 3
mov byte [ebp - 4], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
call esi
push 0x54ede0
call fcn.00507dd0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.00507dd0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42d12d
cmp word [eax], 0
je 0x42d12d
push eax
lea eax, [ebp - 0x20]
call fcn.005080c0
mov ecx, 0x552fa4
lea eax, [ebp - 0x20]
call fcn.00507ba0
test al, al
je 0x42d0b9
mov ecx, str.ScanOcrFolderName
jmp 0x42d0ec
mov ecx, str.Email
lea eax, [ebp - 0x20]
call fcn.00507ba0
test al, al
je 0x42d0d1
mov ecx, str.ScanMailFolderName
jmp 0x42d0ec
mov ecx, str.SharePoint
lea eax, [ebp - 0x20]
call fcn.00507ba0
mov ecx, str.ScanMossFolderName
test al, al
jne 0x42d0ec
mov ecx, str.ScanImgFolderName
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
push edx
push eax
call fcn.004406e0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00508010
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00445e70
push 0x54ede0
call esi
push 0x54ede0
call fcn.00507dd0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push ecx
call fcn.00507dd0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42d141
push eax
call fcn.0051eadb
add esp, 4
lea edx, [ebp - 0x54]
push edx
mov byte [ebp - 4], 0
call fcn.00508490
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x437070
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
xor al, al
mov edi, ecx
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
mov byte [ebp - 0x481], al
test esi, esi
je 0x4371cd
cmp word [esi], 0
je 0x4371cd
test ebx, ebx
je 0x4371cd
mov eax, esi
call fcn.00437580
cmp eax, 0x474
jne 0x4371e7
mov eax, esi
mov esi, edi
call fcn.004494e0
test al, al
je 0x4371e7
mov ecx, 0x474
lea eax, [ebp - 0x480]
lea esp, [esp]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4370f0
mov esi, 0x474
lea edx, [ebp - 0x480]
call fcn.00449560
cmp eax, esi
jne 0x437196
mov ax, word [ebp - 0x42c]
mov edx, dword [ebp - 0x424]
lea edi, [ebx + 0x38]
mov ecx, 7
lea esi, [ebp - 0x448]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x428]
mov dword [ebx + 0x68], ecx
lea edi, [ebx + 0x70]
mov ecx, 0x104
lea esi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [ebx + 0x54], ax
lea eax, [ebx + 4]
lea esi, [ebp - 0x47c]
mov dword [ebx + 0x6c], edx
mov edx, 0x19
sub esi, eax
mov edi, edi
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x437186
movzx ecx, word [esi + eax]
test cx, cx
je 0x437186
mov word [eax], cx
add eax, 2
dec edx
jne 0x437160
sub eax, 2
mov word [eax], dx
mov bl, 1
jmp 0x43719c
test edx, edx
jne 0x43718d
sub eax, 2
xor edx, edx
mov word [eax], dx
mov bl, 1
jmp 0x43719c
mov bl, byte [ebp - 0x481]
mov esi, dword [ebp - 0x488]
call fcn.00449540
test bl, bl
je 0x4371b8
mov eax, dword [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x481]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
Function at 0x437200
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor al, al
mov edi, edx
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x440], ecx
mov byte [ebp - 0x439], al
test ebx, ebx
je 0x4372f8
cmp word [ebx], 0
je 0x4372f8
test ecx, ecx
je 0x4372f8
mov eax, ebx
mov ecx, edi
call fcn.00437580
cmp eax, 0x434
jne 0x43730e
push esi
mov eax, ebx
mov esi, edi
call fcn.004494e0
test al, al
je 0x4372e2
mov ecx, 0x434
lea eax, [ebp - 0x438]
mov byte [eax], 0
inc eax
dec ecx
jne 0x437271
mov esi, 0x434
lea edx, [ebp - 0x438]
call fcn.00449560
cmp eax, esi
jne 0x4372c6
mov eax, dword [ebp - 0x440]
lea edi, [eax + 4]
mov ecx, 7
lea esi, [ebp - 0x434]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x418]
mov word [eax + 0x20], cx
lea edi, [eax + 0x34]
mov ecx, 0x104
lea esi, [ebp - 0x416]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x439], 1
mov esi, dword [ebp - 0x444]
call fcn.00449540
mov al, byte [ebp - 0x439]
test al, al
je 0x4372e8
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, byte [ebp - 0x439]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xc], 0x57
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x439]
xor ecx, ebp
pop edi
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x437330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e8
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
xor al, al
push edi
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8e8], esi
mov byte [ebp - 0x8dd], al
test esi, esi
je 0x437548
cmp word [esi], 0
je 0x437548
test ebx, ebx
je 0x437548
mov eax, esi
call fcn.00437580
mov edi, eax
cmp edi, 0x460
je 0x437396
cmp edi, 0x46c
jne 0x437562
mov eax, esi
mov esi, dword [ebp - 0x8e4]
call fcn.004494e0
test al, al
je 0x437562
cmp edi, 0x460
jne 0x43744f
mov ecx, edi
lea eax, [ebp - 0x8dc]
nop
mov byte [eax], 0
inc eax
dec ecx
jne 0x4373c0
mov edi, dword [ebp - 0x8e4]
mov esi, 0x460
lea edx, [ebp - 0x8dc]
call fcn.00449560
cmp eax, esi
jne 0x437500
mov ax, word [ebp - 0x8bc]
mov edx, dword [ebp - 0x8b4]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x8d8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x8b8]
mov dword [ebx + 0x24], ecx
mov ecx, dword [ebp - 0x8ac]
mov word [ebx + 0x20], ax
mov eax, dword [ebp - 0x8b0]
mov dword [ebx + 0x28], edx
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], ecx
lea ecx, [ebx + 0x34]
lea eax, [ebp - 0x8a8]
call fcn.004378c0
mov edx, dword [ebp - 0x898]
mov eax, dword [ebp - 0x894]
mov dword [ebx + 0x54], edx
mov dword [ebx + 0x58], eax
lea esi, [ebp - 0x890]
jmp 0x4374ed
cmp edi, 0x46c
jne 0x437500
mov ecx, edi
lea eax, [ebp - 0x47c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x437463
mov edi, dword [ebp - 0x8e4]
mov esi, 0x46c
lea edx, [ebp - 0x47c]
call fcn.00449560
cmp eax, esi
jne 0x437500
mov edx, dword [ebp - 0x458]
mov eax, dword [ebp - 0x454]
lea edi, [ebx + 4]
mov ecx, 7
lea esi, [ebp - 0x478]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x45c]
mov dword [ebx + 0x24], edx
mov edx, dword [ebp - 0x44c]
mov word [ebx + 0x20], cx
mov ecx, dword [ebp - 0x450]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x30], edx
test ecx, ecx
je 0x4374d5
lea eax, [ebp - 0x448]
call fcn.00437900
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x428]
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], ecx
lea esi, [ebp - 0x424]
mov ecx, 0x104
lea edi, [ebx + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x8dd], 1
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x8e4]
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x43751c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov bl, byte [ebp - 0x8dd]
test bl, bl
je 0x437533
mov edx, dword [ebp - 0x8e8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov dword [ecx + 0xc], 0x57
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x8dd]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 4
Function at 0x43b1b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebx
xor bl, bl
cmp dword [ebp + 8], 0x101
push edi
sete al
lea edi, [eax + 0x8369]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6a
ja case.default.0x43b1dc
movzx ecx, byte [eax + 0x43b26c]
push esi
jmp dword [ecx*4 + 0x43b24c]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0
test al, 0x80
setne dl
lea esi, [edx + 1]
jmp 0x43b227
mov esi, 4
jmp 0x43b227
mov esi, 3
jmp 0x43b227
mov esi, 2
jmp 0x43b227
mov esi, 1
jmp 0x43b227
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns case.0x43b1dc.16
mov esi, 5
xor bl, bl
call fcn.00513310
test eax, eax
je case.0x43b1dc.16
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
pop esi
pop edi
mov al, bl
pop ebx
pop ebp
ret 0xc
Function at 0x43ee10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5395a6
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, edx
xor al, al
mov dword [ebp - 0x264], esi
test ebx, ebx
je 0x43ef88
cmp word [ebx], 0
je 0x43ef88
push ecx
lea eax, [ebp - 0x270]
push eax
push esi
call fcn.0043f4b0
add esi, 0x58
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00508010
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x43ee96
push eax
call fcn.0051eadb
add esp, 4
push 0x54ede0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
mov edi, esi
call fcn.00507dd0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call fcn.00507dd0
mov ebx, dword [ebp - 0x264]
cmp dword [ebx + 0x68], 0
lea edi, [ebx + 0x64]
jle 0x43eee1
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push ecx
push 0
push edx
call fcn.00522610
add esp, 0xc
mov dword [edi + 4], 0
mov eax, dword [esi]
test eax, eax
jne 0x43eeec
mov eax, 0x54ee24
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x43ef84
mov edx, dword [ebp + 0xc]
push edx
mov ecx, ebx
call fcn.0043f720
test al, al
jne 0x43ef91
mov ecx, 0x2e
call fcn.00507b70
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [eax + 1]
mov ecx, esi
call fcn.00507640
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00508010
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], 0xffffffff
call fcn.00445e70
push 0x5538fc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5538fc
call fcn.00507dd0
mov edi, dword [edi]
test edi, edi
jne 0x43ef6d
mov edi, 0x54ee24
mov esi, dword [esi]
mov eax, esi
test esi, esi
jne 0x43ef7a
mov eax, 0x54ee24
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov al, 1
jmp 0x43ef93
mov dword [esi + 0x70], 0x57
jmp 0x43ef93
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret 8
Function at 0x43f5d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539518
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x40]
add edi, 0x40
test esi, esi
je 0x43f662
cmp word [esi], 0
je 0x43f662
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f657
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x43f66b
mov dword [ebp - 0x10], 2
mov eax, dword [edi]
test eax, eax
jne 0x43f63a
mov eax, 0x54ee24
xor bl, bl
test eax, eax
je 0x43f67a
cmp word [eax], 0
je 0x43f67a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x43f66f
mov bl, 1
jmp 0x43f681
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x43f62f
mov dword [ebp - 0x10], 0x57
jmp 0x43f62f
mov bl, 1
jmp 0x43f685
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x43f681
mov dword [ebp - 0x10], 0x57
test bl, bl
je 0x43f6f7
mov eax, dword [ebp + 8]
cmp dword [eax + 0x50], 0
jle 0x43f6f3
push edi
lea ecx, [ebp - 0x1c]
call fcn.005072e0
push 0x54ede0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
lea edi, [ebp - 0x1c]
call fcn.00507dd0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x4c]
mov eax, dword [eax + 0x50]
push ecx
call fcn.00507dd0
mov esi, dword [ebp - 0x1c]
mov eax, esi
test esi, esi
jne 0x43f6d3
mov eax, 0x54ee24
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.00449cf0
mov bl, al
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x43f6f3
push esi
call fcn.0051eadb
add esp, 4
test bl, bl
jne 0x43f700
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43f720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x58]
sub esp, 8
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
jne 0x43f736
mov eax, 0x54ee24
lea esi, [ecx + 0x34]
call fcn.004494e0
test al, al
je 0x43f795
mov eax, dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, 0xffffffff
je 0x43f79f
push ebx
lea ecx, [ebp - 4]
push ecx
push 4
lea edx, [ebp - 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43f76f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
cmp dword [ebp - 4], 4
jne 0x43f77f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x43f77f
mov bl, 1
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x43f795
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], 0xc
jmp 0x43f77f
Function at 0x440900
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5347d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x18]
xor bl, bl
call fcn.0043fe50
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
jle 0x4409e7
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x440951
mov esi, 0x54ee24
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x440979
cmp word [esi], 0
je 0x440979
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x440977
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x440979
jmp 0x4409a8
call edi
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x440985
mov eax, 0x54ee24
xor bl, bl
test eax, eax
je 0x4409a4
cmp word [eax], 0
je 0x4409a4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4409a2
mov bl, 1
jmp 0x4409a4
call edi
test bl, bl
je 0x4409e7
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4409b4
mov eax, 0x54ee24
xor cl, cl
test eax, eax
je 0x4409e5
cmp word [eax], 0
je 0x4409e5
mov edi, dword [ebp + 8]
add edi, 0x64
push eax
mov eax, edi
call fcn.005080c0
push 0x5c
mov esi, edi
call fcn.00507e80
mov esi, str.CcComDef.dat
mov eax, edi
call fcn.00508170
mov cl, 1
mov bl, cl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4409fe
push eax
call fcn.0051eadb
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x444fd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
xor al, al
push esi
mov esi, edx
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x445061
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esi, 0x10
mov word [ebp - 0x24], ax
mov eax, dword [esi + 4]
xor edi, edi
test eax, eax
je 0x44502a
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
test edi, edi
jg 0x44502a
mov edx, dword [esi]
mov ebx, dword [edx + 4]
add ebx, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov bl, 1
test edi, edi
jg 0x44503c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44503c
xor bl, bl
test bl, bl
je 0x44505d
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
call fcn.00445070
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051eacc
mov esp, ebp
pop ebp
ret