joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003cb60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003cd10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003cc2d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003cbaa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10052004]
ja 0x1003cbaa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003cb7a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10017210
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003cbd0
jmp 0x1003cc2d
cmp dword [ebp - 0x14], 0x10000
jne 0x1003cc13
cmp dword [ebp - 0x18], 0x10000
jb 0x1003cc13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003cc06
mov eax, dword [ebp - 8]
jmp 0x1003cc2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003cc28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003cd10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003cb7a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003cc40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003cd40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003cd05
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003cc85
mov eax, dword [ebp - 4]
cmp eax, dword [0x10052004]
ja 0x1003cc85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003cc55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10017210
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003ccab
jmp 0x1003cd05
cmp dword [ebp - 0x14], 0x10000
jne 0x1003ccee
cmp dword [ebp - 0x18], 0x10000
jb 0x1003ccee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003cce1
mov eax, dword [ebp - 8]
jmp 0x1003cd07
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003cd00
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003cd40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003cc55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003e110
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100539f0], eax
je 0x1003e12e
mov eax, 0x10dd
jmp 0x1003e20f
mov eax, dword [0x10053a00]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003e1ac
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003e18a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003e18a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1003d1c0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10014c20
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003e136
mov dword [0x10053a00], 0
call fcn.1003daa0
mov ecx, dword [0x100539fc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003e1f9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10014c20
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003e1c4
mov dword [0x100539fc], 0
mov dword [0x100539f0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003e6f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100539f4], 0
je 0x1003e709
mov eax, dword [0x100539f4]
jmp 0x1003e7a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1003e71b
xor eax, eax
jmp 0x1003e7a9
push 8
call fcn.10016070
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003e771
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003e75a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10014c20
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100539f4], eax
mov dword [0x100539f8], 0
mov eax, dword [ebp - 8]
jmp 0x1003e7a9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1003e78b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003e73b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100539fc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100539fc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x417cf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x4b0780]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x4b60cc], 0
push esi
je 0x417d20
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.0048cef3
add esp, 4
test eax, eax
je 0x417d3e
push 0
mov ecx, eax
call fcn.00417b50
mov dword [0x4b60cc], eax
jmp 0x417d48
mov dword [0x4b60cc], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x417d70
xor ecx, ecx
jmp 0x417d84
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417d75
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.0041aec0
mov ecx, dword [0x4b60cc]
lea eax, [esp + 4]
push eax
call fcn.00418d50
cmp dword [esp + 0x18], 8
jb 0x417db2
push dword [esp + 4]
call fcn.0048cf69
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret

Function at 0x418d50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x4b0780]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 8], 0
mov ecx, 0x413b1c
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
lea edx, [ecx + 2]
mov word [esp + 0x24], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418da3
sub ecx, edx
sar ecx, 1
push ecx
push 0x413b1c
lea ecx, [esp + 0x2c]
call fcn.0041aec0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 3
lea edx, [esp + 0x2c]
call fcn.0042c030
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x418de9
push dword [esp + 0x24]
call fcn.0048cf69
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x418e27
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.00417ed0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x418e3a
push dword [esp + 0xc]
call fcn.0048cf69
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret 4
Function at 0x422e70
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
cmp eax, 0x104
jb 0x422e8e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x422e99
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
jne 0x422eec
lea ecx, [esp + 8]
call fcn.0042ee50
mov edx, ecx
mov ecx, esi
call fcn.004239b0
test al, al
je 0x422ed5
cmp byte [esp + 0x10], 0
je 0x422ed5
cmp dword [esi + 0x14], 8
jb 0x422ec4
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x422edf
mov eax, dword [esi]
jmp 0x422ee1
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x422e92
mov ecx, esi
call fcn.00424300
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4232e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4232ee
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x423300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x42330e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x423322
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x423330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4b0780]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x42348d
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00419550
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x220], 0
push eax
call fcn.0041a2c0
push 1
push 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.0041a3e0
cmp eax, 0xffffffff
je 0x4233db
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x230]
call fcn.0041b090
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.0041e1e0
cmp esi, eax
je 0x4233fd
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.0041a2c0
cmp dword [ebp - 0x234], 8
jb 0x423414
push dword [ebp - 0x248]
call fcn.0048cf69
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x423448
push dword [ebp - 0x230]
call fcn.0048cf69
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x24c], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x42347c
push dword [ebp - 0x260]
call fcn.0048cf69
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
Function at 0x4234a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4b0780]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x423511
cmp word [ebp - 0x210], 0
je 0x423511
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00419550
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
call fcn.0041d6b0
cmp dword [ebp - 0x214], 8
jb 0x42362f
push dword [ebp - 0x228]
jmp 0x423627
xor eax, eax
mov dword [ebp - 0x22c], 7
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
call fcn.00423330
test al, al
je 0x423566
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x240]
push eax
call fcn.0041a2c0
jmp 0x423618
push 3
xor eax, eax
mov dword [ebp - 0x214], 7
push 0x4130ec
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.0041aec0
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.0041a2c0
push 1
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
mov ecx, esi
call fcn.0041a3e0
cmp eax, 0xffffffff
je 0x4235e4
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0041b090
cmp dword [ebp - 0x214], 8
jb 0x4235fb
push dword [ebp - 0x228]
call fcn.0048cf69
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x22c], 8
jb 0x42362f
push dword [ebp - 0x240]
call fcn.0048cf69
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
Function at 0x423640
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4b0780]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
mov dword [ebp - 0x54], eax
xor eax, eax
push edi
mov dword [ebp - 0x58], edx
xor edi, edi
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
jmp 0x423680
xor eax, eax
mov dword [ebp - 0xc], 7
push 0xffffffffffffffff
push eax
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 0
mov word [ebp - 0x20], ax
call fcn.0041a2c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.00424b30
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041a1f0
cmp dword [ebp - 0x3c], 8
jb 0x4236d1
push dword [ebp - 0x50]
call fcn.0048cf69
add esp, 4
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmovae ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x20]
cmovae ecx, dword [ebp - 0x20]
test eax, eax
je 0x4236f1
sub eax, ecx
sar eax, 1
push 0x5f
push 1
push eax
lea ecx, [ebp - 0x20]
call fcn.0041afc0
mov edi, edi
lea ecx, [ebp - 0x64]
call fcn.0043c140
cmp dword [ebp - 0x60], 0xffffffff
ja 0x423700
mov edx, dword [ebp - 0x64]
jb 0x42371b
cmp edx, 0xffff7fff
ja 0x423700
and edx, 0x7fff
lea ecx, [ebp - 0x50]
call fcn.00424b30
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041a1f0
cmp dword [ebp - 0x3c], 8
jb 0x42374a
push dword [ebp - 0x50]
call fcn.0048cf69
add esp, 4
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0041dea0
lea ecx, [ebp - 0x38]
cmp ecx, eax
je 0x42376b
push 0xffffffffffffffff
push 0
push eax
call fcn.0041a2c0
cmp dword [ebp - 0x3c], 8
jb 0x42377c
push dword [ebp - 0x50]
call fcn.0048cf69
add esp, 4
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0
cmovae eax, dword [ebp - 0x38]
push eax
call ebx
test eax, eax
jne 0x4237b2
cmp dword [ebp - 0xc], 8
jb 0x4237a1
push dword [ebp - 0x20]
call fcn.0048cf69
add esp, 4
mov edx, dword [ebp - 0x58]
inc edi
cmp edi, 0x32
jl 0x423680
xor bl, bl
jmp 0x4237db
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x38]
cmp eax, ecx
je 0x4237c8
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.0041a2c0
cmp dword [ebp - 0xc], 8
jb 0x4237d9
push dword [ebp - 0x20]
call fcn.0048cf69
add esp, 4
mov bl, 1
cmp dword [ebp - 0x24], 8
jb 0x4237ec
push dword [ebp - 0x38]
call fcn.0048cf69
add esp, 4
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
Function at 0x423880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4b0780]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x4238af
mov ebx, dword [edi]
jmp 0x4238b1
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4238f3
test al, 0x10
je 0x4238d5
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4238df
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0041dcc0
cmp dword [edi + 0x14], 8
jb 0x423909
mov eax, dword [edi]
jmp 0x42390b
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.0041b140
test eax, eax
jne 0x423930
test esi, esi
je 0x42397d
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x423983
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00423880
add esp, 8
test al, al
jne 0x423946
xor bl, bl
jmp 0x423983
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x423981
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x423970
push edi
call fcn.00423300
add esp, 4
test al, al
jne 0x423981
test esi, esi
je 0x42397d
mov ecx, ebx
call fcn.0042f0c0
mov dword [esi], eax
xor bl, bl
jmp 0x423983
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x423996
push dword [esp + 0x14]
call fcn.0048cf69
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
Function at 0x423ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], 0
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0x10]
jb 0x423bc5
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ecx, ecx
mov dword [esp + 0x10], ecx
test esi, esi
je 0x423c64
lea ecx, [esp + 0x10]
call fcn.004245a0
cmp esi, 0xffffffff
je 0x423c31
mov dword [esp + 0x10], esi
call fcn.00428510
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 4]
mov ecx, dword [0x4b6178]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x423c1e
call fcn.00428620
mov ecx, dword [0x4b6178]
push dword [esp + 0x1c]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push dword [esp + 0x18]
push edx
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x423c64
cmp ecx, 0xffffffff
je 0x423c64
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x423c60
mov esi, dword [esp + 0x18]
cmp esi, edi
jne 0x423c60
mov ecx, dword [esp + 0x10]
jmp 0x423c67
mov ecx, dword [esp + 0x10]
or esi, 0xffffffff
test ecx, ecx
je 0x423cc5
cmp ecx, 0xffffffff
je 0x423cc5
call fcn.00428510
mov ebx, dword [ebp + 4]
mov edi, eax
mov ecx, dword [0x4b6178]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x423c97
call fcn.00428620
mov ecx, dword [0x4b6178]
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edi
push ebx
push edx
push dword [esp + 0x20]
call dword [eax + 8]
mov ecx, dword [0x4b6178]
mov edi, dword [esp + 0x10]
test ecx, ecx
jne 0x423cc0
call fcn.00428620
mov ecx, dword [0x4b6178]
mov edx, dword [ecx]
push edi
call dword [edx]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4b0780]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x424249
cmp eax, 0x104
ja 0x424249
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.00419550
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.0041d6b0
mov ecx, eax
call fcn.0041e1e0
cmp esi, eax
je 0x4241d6
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.0041a2c0
cmp dword [ebp - 0x214], 8
jb 0x4241ed
push dword [ebp - 0x228]
call fcn.0048cf69
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
cmp dword [ebp - 0x244], 8
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x424221
push dword [ebp - 0x258]
call fcn.0048cf69
add esp, 4
cmp dword [ebp - 0x22c], 8
jb 0x424238
push dword [ebp - 0x240]
call fcn.0048cf69
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00490c9e
mov esp, ebp
pop ebp
ret

Function at 0x424280
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ecx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0041e240
test al, al
jne 0x4242ec
mov ecx, esi
call fcn.0041e240
test al, al
jne 0x4242ec
cmp dword [edi + 0x10], 0x104
jae 0x4242ec
cmp dword [esi + 0x10], 0x104
jae 0x4242ec
cmp dword [esi + 0x14], 8
jb 0x4242b5
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x4242bd
mov edi, dword [edi]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4242ec
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4242ec
test al, 1
je 0x4242e6
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 1
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x424300
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x4b0780]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov word [ebp - 0x40], 0
push ebx
push esi
lea edx, [ebp - 0x48]
movlpd qword [ebp - 0x48], xmm0
mov esi, ecx
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
call fcn.004239b0
test al, al
je 0x42443b
cmp byte [ebp - 0x40], 0
jne 0x42436e
cmp dword [esi + 0x14], 8
jb 0x424352
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
push 3
push 0
push esi
lea ecx, [ebp - 0x2f0]
mov bl, 1
call fcn.00431090
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00431270
cmp dword [ebp - 0xc], 0
je 0x4243d6
lea ecx, [ebp - 0x1c]
call fcn.00424300
and bl, al
lea ecx, [ebp - 0x2f0]
lea eax, [ebp - 0x38]
push eax
call fcn.00431270
lea ecx, [ebp - 0x1c]
cmp ecx, eax
je 0x4243bf
push 0xffffffffffffffff
push 0
push eax
call fcn.0041a2c0
cmp dword [ebp - 0x24], 8
jb 0x4243d0
push dword [ebp - 0x38]
call fcn.0048cf69
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x424395
cmp dword [ebp - 8], 8
jb 0x4243e7
push dword [ebp - 0x1c]
call fcn.0048cf69
add esp, 4
xor eax, eax
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
test bl, bl
je 0x424430
cmp dword [esi + 0x14], 8
jb 0x424407
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
lea ecx, [ebp - 0x2f0]
setne bl
call fcn.00431160
mov al, bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490c9e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2f0]
call fcn.00431160
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.00490c9e
mov esp, ebp
pop ebp
ret