joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ba4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4425a9
call fcn.00441b80
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x44b558
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x18]
push 3
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x24]
push 3
mov byte [ebp - 4], 2
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
lea ecx, [esi + 0x30]
push 3
mov byte [ebp - 4], 3
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00403396
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], 4
mov dword [esi + 0x3c], 0x44b510
mov dword [esi], 0x44b528
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402c6d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4425f0
call fcn.00441b80
push ecx
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea edi, [esi + 0x3c]
mov dword [ebp - 0x14], edi
mov dword [edi], 0x44b510
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.00428327
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.004282fe
push dword [esi + 0x30]
call fcn.004284d8
push dword [esi + 0x24]
call fcn.004284d8
push dword [esi + 0x18]
call fcn.004284d8
push dword [esi + 0xc]
call fcn.004284d8
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword [esi], 0x44b588
mov dword fs:[0], ecx
pop edi
pop esi
leave
ret

Function at 0x405ea8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x405ef2
cmp dword [ebp - 0x84], 2
jne 0x405ef2
cmp dword [ebp - 0x90], 5
jb 0x405ef2
jbe 0x405ee4
mov al, 1
leave
ret
cmp dword [ebp - 0x8c], 1
jb 0x405ef2
seta al
leave
ret
xor al, al
leave
ret
Function at 0x40820b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x443067
call fcn.00441b80
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 3
mov dword [ebp - 0x10], esi
mov dword [esi], 0x44bc00
mov dword [esi + 4], 0x44bbf0
mov dword [esi + 8], 0x44bbc4
mov dword [esi + 0xc], 0x44bbb4
mov dword [esi + 0x10], 0x44bba4
mov dword [esi + 0x14], 0x44bb94
lea ecx, [esi + 0x20]
mov dword [esi + 0x18], 0x44bb84
mov dword [esi + 0x1c], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00403396
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
call fcn.004082e9
push 4
lea eax, [esi + 0x90]
pop ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x44bb7c
lea eax, [esi + 0xac]
mov dword [esi + 0xa4], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0x44bb74
mov byte [esi + 0xc0], bl
or dword [esi + 0xc4], 0xffffffff
mov dword [esi], 0x44bb44
mov dword [esi + 4], 0x44bb34
mov dword [esi + 8], 0x44bb08
mov dword [esi + 0xc], 0x44baf8
mov dword [esi + 0x10], 0x44bae8
mov dword [esi + 0x14], 0x44bad8
mov dword [esi + 0x18], 0x44bac8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40b42f
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x443860
call fcn.00441b80
sub esp, 0x30
mov eax, dword [ecx]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], ecx
mov dword [ecx + 4], edi
mov word [eax], di
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp si, ax
jne 0x40b53e
mov esi, eax
push 4
shr ax, 0xa
lea ecx, [ebp - 0x3c]
and esi, 0x3ff
mov dword [ebp - 0x1c], eax
call fcn.00402794
mov ebx, 0x44bcf4
mov dword [ebp - 0x3c], ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], edi
call fcn.0040b1de
cmp dword [ebp - 0x34], edi
mov dword [ebp - 0x14], edi
jle 0x40b520
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
push 3
mov edi, dword [eax + ecx*4]
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
call fcn.00403396
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push 2
mov byte [ebp - 4], 1
call fcn.00427f75
test al, al
je 0x40b504
lea eax, [ebp - 0xe]
lea edx, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040b3c2
test al, al
je 0x40b504
cmp word [ebp - 0x10], si
jne 0x40b504
cmp word [ebp - 0xe], 0
jne 0x40b4fa
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 0x14]
push eax
call fcn.0040312c
mov ax, word [ebp - 0xe]
cmp word [ebp - 0x1c], ax
je 0x40b54d
push dword [ebp - 0x28]
and byte [ebp - 4], 0
call fcn.004284d8
inc dword [ebp - 0x14]
pop ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jl 0x40b49b
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00428327
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004282fe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov ecx, dword [ebp - 0x18]
add edi, 0x14
push edi
call fcn.0040312c
push dword [ebp - 0x28]
call fcn.004284d8
pop ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 4], 2
jmp 0x40b52a
Function at 0x415020
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x444c7c
call fcn.00441b80
sub esp, 0x60
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
mov esi, ecx
je 0x4150a1
mov eax, dword [edx]
cmp dword [esi + 4], ebx
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
jne 0x415060
xor esi, esi
jmp 0x415062
mov esi, dword [esi]
push str.ShellExecuteExW
push 0x45ba48
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41514a
lea ecx, [ebp - 0x6c]
push ecx
call eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
jmp 0x415115
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.0043a785
mov edx, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0043a785
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
mov dword [ebp - 0x50], 1
and eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
push dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
call fcn.004284d8
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.004284d8
pop ecx
pop ecx
cmp esi, 0x20
ja 0x41514a
cmp esi, 0x1f
jne 0x41514a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.0040421e
push 0x10
push str.7_Zip
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x30]
call fcn.004284d8
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42620c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 8]
shr eax, 0xf
movzx ecx, word [ecx + 0xc]
and al, 1
sub ecx, 0x26
je 0x426239
dec ecx
dec ecx
je 0x426231
xor al, al
jmp 0x426248
test al, al
je 0x426246
push 0
jmp 0x42623f
test al, al
je 0x426246
push 1
mov ecx, esi
call fcn.0042624c
mov al, 1
pop esi
ret 4

Function at 0x4271cd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x446f1a
call fcn.00441b80
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004030f2
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.004030f2
mov al, byte [edi + 0x18]
lea ecx, [esi + 0x38]
mov byte [esi + 0x18], al
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
lea eax, [edi + 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.004030f2
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
push eax
mov byte [ebp - 4], 2
call fcn.004030f2
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4293af
Capabilities:
Write clipboard data

Disassembly:
mov eax, 0x447268
call fcn.00441b80
push ecx
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0x2002
call fcn.0042c483
test al, al
jne 0x4293e1
xor bl, bl
jmp 0x429417
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4293dd
push dword [ebp + 8]
push edi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4293dd
and dword [ebp - 0x10], 0
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042c4a4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x429cce
Capabilities:
Get common file path

Disassembly:
mov eax, 0x447350
call fcn.00441b80
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
mov esi, ecx
je 0x429d33
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x429cfa
push edi
call fcn.00403396
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x429d17
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x429d0f
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
pop edi
jbe 0x429d2f
cmp eax, 0x104
ja 0x429d2f
push 1
pop eax
jmp 0x429d82
xor eax, eax
jmp 0x429d82
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004034e3
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00429c91
test al, al
je 0x429d77
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00429d90
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040312c
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x429e88
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x429f11
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x447378
call fcn.00441b80
sub esp, 0x18
cmp byte [0x45d8b4], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x429f52
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.00429fbd
mov eax, dword [eax]
mov edx, edi
mov ecx, eax
call fcn.00429e88
mov bl, al
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov al, bl
jmp 0x429fae
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call esi
test eax, eax
je 0x429f64
mov al, 1
jmp 0x429fae
xor eax, eax
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call fcn.00403396
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
mov ecx, ebx
call fcn.0042bd5e
test al, al
je 0x429fa3
push edi
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.004284d8
test esi, esi
pop ecx
setne al
jmp 0x429fae
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42a00c
Capabilities:
Delete directory

Disassembly:
mov eax, 0x4473a0
call fcn.00441b80
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
push edi
mov edi, ecx
jne 0x42a048
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00429fbd
mov ecx, dword [eax]
call fcn.00429e96
mov bl, al
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov al, bl
jmp 0x42a09c
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call esi
test eax, eax
je 0x42a059
mov al, 1
jmp 0x42a09c
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403396
lea edx, [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042bd5e
test al, al
push dword [ebp - 0x18]
je 0x42a094
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.004284d8
cmp esi, ebx
pop ecx
setne al
jmp 0x42a09c
call fcn.004284d8
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42a0ab
Capabilities:
Move file

Disassembly:
mov eax, 0x4473c4
call fcn.00441b80
sub esp, 0x34
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
jne 0x42a108
lea ecx, [ebp - 0x40]
call fcn.00429fbd
mov edx, dword [ebp - 0x10]
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.00429fbd
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.00429f03
mov bl, al
push dword [ebp - 0x34]
call fcn.004284d8
push dword [ebp - 0x40]
call fcn.004284d8
pop ecx
mov al, bl
pop ecx
jmp 0x42a195
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
push ecx
call esi
test eax, eax
je 0x42a11a
mov al, 1
jmp 0x42a195
push 3
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.00403396
push 3
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00403396
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
mov edx, edi
mov byte [ebp - 4], 2
call fcn.00429ea3
test al, al
push dword [ebp - 0x1c]
je 0x42a184
push dword [ebp - 0x28]
call esi
mov esi, eax
push dword [ebp - 0x1c]
call fcn.004284d8
push dword [ebp - 0x28]
call fcn.004284d8
pop ecx
cmp esi, ebx
pop ecx
setne al
jmp 0x42a195
call fcn.004284d8
push dword [ebp - 0x28]
call fcn.004284d8
pop ecx
xor al, al
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42a1b3
Capabilities:
Create directory

Disassembly:
mov eax, 0x4473d8
call fcn.00441b80
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
push edi
mov edi, ecx
jne 0x42a1ef
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00429fbd
mov ecx, dword [eax]
call fcn.0042a1a4
mov bl, al
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov al, bl
jmp 0x42a255
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push edi
call esi
test eax, eax
je 0x42a201
mov al, 1
jmp 0x42a255
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42a253
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403396
lea edx, [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042bd5e
test al, al
je 0x42a24a
push ebx
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.004284d8
cmp esi, ebx
pop ecx
setne al
jmp 0x42a255
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42a481
Capabilities:
Delete file

Disassembly:
mov eax, 0x447420
call fcn.00441b80
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
push edi
mov edi, ecx
jne 0x42a4bd
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00429fbd
mov ecx, dword [eax]
call fcn.0042a463
mov bl, al
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov al, bl
jmp 0x42a51e
xor edx, edx
mov ecx, edi
call fcn.00429f11
test al, al
je 0x42a51c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
je 0x42a4db
mov al, 1
jmp 0x42a51e
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00403396
lea edx, [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.0042bd5e
test al, al
push dword [ebp - 0x18]
je 0x42a516
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.004284d8
cmp esi, ebx
pop ecx
setne al
jmp 0x42a51e
call fcn.004284d8
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42ab81
Capabilities:
Get common file path

Disassembly:
mov eax, 0x447538
call fcn.00441b80
sub esp, 0x18
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x45d8b4], bl
je 0x42abed
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x42abb5
push edi
call fcn.00403396
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x42abd1
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x42abc9
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
pop edi
jbe 0x42abe9
cmp eax, 0x104
ja 0x42abe9
push 1
pop eax
jmp 0x42ac3c
xor eax, eax
jmp 0x42ac3c
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004034e3
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0042ab45
test al, al
je 0x42ac31
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00429d90
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0040312c
push dword [ebp - 0x24]
call fcn.004284d8
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.004284d8
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42ac4a
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov eax, 0x105
push edi
mov edi, edx
cmp dword [esi + 8], eax
mov ebx, ecx
jg 0x42ac67
push eax
mov ecx, esi
call fcn.004034e3
push dword [esi]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, esi
mov edi, eax
call fcn.00428d27
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x42ac84
Capabilities:
Get common file path

Disassembly:
mov eax, 0x447582
call fcn.00441b80
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp byte [0x45d8b4], bl
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
je 0x42ace7
mov esi, dword [ebp + 8]
mov eax, 0x104
cmp dword [esi + 8], eax
jg 0x42acbb
push eax
mov ecx, esi
call fcn.00403396
push dword [esi]
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x42acdb
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x42acd3
mov word [ecx + edx*2], bx
mov dword [esi + 4], edx
jmp 0x42ad98
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004034e3
cmp edi, ebx
mov dword [ebp - 4], ebx
je 0x42ad1a
mov edx, edi
lea ecx, [ebp - 0x38]
call fcn.00429fbd
mov dword [ebp - 0x10], 1
mov esi, dword [eax]
mov byte [ebp - 4], 1
jmp 0x42ad1c
xor esi, esi
mov edx, dword [ebp - 0x14]
cmp edx, ebx
je 0x42ad38
lea ecx, [ebp - 0x2c]
call fcn.00429fbd
push 2
pop ecx
or dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov ecx, dword [eax]
jmp 0x42ad3a
xor ecx, ecx
lea eax, [ebp - 0x20]
mov edx, esi
push eax
call fcn.0042ac4a
test byte [ebp - 0x10], 2
mov esi, eax
je 0x42ad5a
push dword [ebp - 0x2c]
and dword [ebp - 0x10], 0xfffffffd
call fcn.004284d8
pop ecx
test byte [ebp - 0x10], 1
mov dword [ebp - 4], ebx
je 0x42ad6c
push dword [ebp - 0x38]
call fcn.004284d8
pop ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.00429d90
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.0040312c
push dword [ebp - 0x38]
call fcn.004284d8
push dword [ebp - 0x20]
call fcn.004284d8
pop ecx
mov eax, esi
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42b8ab
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4476e4
call fcn.00441b80
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.00428327
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ebx, ebx
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x42b8dc
xor al, al
jmp 0x42b97b
push 3
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.004034e3
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
jl 0x42b900
push edi
lea ecx, [ebp - 0x2c]
call fcn.004034e3
push dword [ebp - 0x2c]
push edi
call esi
mov esi, eax
cmp esi, ebx
je 0x42b970
cmp esi, edi
ja 0x42b970
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004034e3
xor edi, edi
cmp esi, ebx
mov byte [ebp - 4], 1
jbe 0x42b960
mov eax, dword [ebp - 0x2c]
mov al, byte [edi + eax]
cmp al, bl
mov byte [ebp - 0x14], al
jne 0x42b950
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.004128a8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
mov byte [eax], bl
jmp 0x42b95b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00412848
inc edi
cmp edi, esi
jb 0x42b92d
cmp dword [ebp - 0x1c], ebx
jne 0x42b967
mov bl, 1
push dword [ebp - 0x20]
call fcn.004284d8
pop ecx
push dword [ebp - 0x2c]
call fcn.004284d8
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42b98a
Capabilities:
Get disk information

Disassembly:
mov eax, 0x447718
call fcn.00441b80
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
call fcn.00428327
xor ebx, ebx
cmp byte [0x45d8b4], bl
je 0x42ba65
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push ebx
push ebx
call esi
mov edi, eax
cmp edi, ebx
jne 0x42b9c7
xor al, al
jmp 0x42badf
push 3
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.00403396
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
jl 0x42b9eb
push edi
lea ecx, [ebp - 0x2c]
call fcn.00403396
push dword [ebp - 0x2c]
push edi
call esi
mov esi, eax
cmp esi, ebx
je 0x42ba58
cmp esi, edi
ja 0x42ba58
push 3
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00403396
xor edi, edi
cmp esi, ebx
mov byte [ebp - 4], 1
jbe 0x42ba49
mov eax, dword [ebp - 0x2c]
mov ax, word [eax + edi*2]
cmp ax, bx
jne 0x42ba3b
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
call fcn.004032b4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
mov word [eax], bx
jmp 0x42ba44
push eax
lea ecx, [ebp - 0x20]
call fcn.0040316a
inc edi
cmp edi, esi
jb 0x42ba18
cmp dword [ebp - 0x1c], ebx
push dword [ebp - 0x20]
sete bl
call fcn.004284d8
pop ecx
push dword [ebp - 0x2c]
call fcn.004284d8
pop ecx
mov al, bl
jmp 0x42badf
push 4
lea ecx, [ebp - 0x4c]
call fcn.00402794
mov edi, 0x44c320
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 2
call fcn.0042b8ab
xor esi, esi
cmp dword [ebp - 0x44], ebx
mov byte [ebp - 0xd], al
jle 0x42babe
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x38]
mov edx, dword [eax + esi*4]
call fcn.0041242c
mov ecx, dword [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.004032b4
mov byte [ebp - 4], 2
push dword [ebp - 0x38]
call fcn.004284d8
inc esi
pop ecx
cmp esi, dword [ebp - 0x44]
jl 0x42ba90
mov dword [ebp - 0x4c], edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 4
call fcn.00428327
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004282fe
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret