joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b61e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x2c
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00408740
push 0x2c
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00408740
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov ebx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
add esp, 0x18
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], esi
xor esi, esi
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp + 0x28]
push 0x41b36e
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 0x2c]
push esi
push esi
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x41b70c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x41b6e2
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x41b6ed
mov ebx, 0x80004005
push ebx
push 0x3bd
push 0x442c94
call fcn.004315ca
push 0x443df8
push ebx
call fcn.004315b6
pop ecx
pop ecx
jmp 0x41b753
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x41b41e
push dword [ebp + 0xc]
call fcn.0040d558
mov ebx, eax
cmp ebx, esi
jge 0x41b736
push 0x443d48
push ebx
call fcn.004315b6
pop ecx
pop ecx
jmp 0x41b74c
push edi
call fcn.0041932c
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x38
Function at 0x41ba34
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 1
push ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x41ba9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x41ba79
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x41ba87
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x3b
push 0x443e56
call fcn.004315ca
push 0x443ed8
jmp 0x41bafc
mov esi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0x41b87e
push ebx
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x41bb08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x41bada
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x41bae8
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x44
push 0x443e56
call fcn.004315ca
push 0x443eb8
push dword [ebp - 4]
call fcn.004315b6
pop ecx
pop ecx
jmp 0x41bb23
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov eax, dword [ebp - 8]
mov dword [esi + 0x1e0], eax
mov dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x41bb36
push dword [ebp - 8]
call esi
mov dword [ebp - 8], ebx
cmp dword [ebp - 0xc], ebx
je 0x41bb40
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41c1c0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0x198], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00408740
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
mov esi, 0x104
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x41c24c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41c227
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41c232
mov esi, 0x80004005
push esi
push 0x24e
push 0x4442dc
call fcn.004315ca
push 0x4442c0
jmp 0x41c2fa
lea eax, [ebp - 0x78]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
call fcn.0041c108
mov esi, eax
cmp esi, edi
jge 0x41c26a
push 0x44429a
jmp 0x41c2fa
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x41c2e2
push dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push 0x444292
push eax
call fcn.004300a2
mov esi, eax
add esp, 0xc
cmp esi, edi
jge 0x41c2a0
push 0x444268
jmp 0x41c2fa
lea eax, [ebp - 0x7c]
push eax
push SysReAllocString
push dword [ebp - 0x74]
call fcn.0041c108
mov esi, eax
cmp esi, edi
jge 0x41c2be
push 0x44423c
jmp 0x41c2fa
push dword [ebp - 0x7c]
mov esi, dword [ebp - 0x78]
push dword [ebp - 0x74]
sub esi, dword [ebp - 0x7c]
push dword [ebp - 0x7c]
lea eax, [ebp + esi*2 - 0x70]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x41c2e2
mov dword [ebp - 0x78], esi
push dword [ebp - 0x78]
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.0042fb3e
mov esi, eax
cmp esi, edi
jge 0x41c302
push 0x444220
push esi
call fcn.004315b6
pop ecx
pop ecx
cmp dword [ebp - 0x74], edi
je 0x41c30f
push dword [ebp - 0x74]
call fcn.0042ecb2
mov ecx, dword [ebp + 0x198]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004084b8
add ebp, 0x19c
leave
ret
Function at 0x41f76e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
push edi
push 1
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x41f7d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41f7b3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41f7be
mov esi, 0x80004005
push esi
push 0x41
push 0x445aba
call fcn.004315ca
push 0x445b58
jmp 0x41f835
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x41f5aa
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x41f83f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41f818
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x41f823
mov esi, 0x80004005
push esi
push 0x4a
push 0x445aba
call fcn.004315ca
push 0x445b3c
push esi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x41f84e
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x41f861
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x41f86b
push dword [ebp - 0xc]
call esi
pop edi
pop esi
leave
ret 0xc

Function at 0x4209a6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
mov esi, ecx
call fcn.00408740
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x420a20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4209fe
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x420a09
mov esi, 0x80004005
push esi
push 0x45d
push 0x446162
call fcn.004315ca
push 0x446136
jmp 0x420a41
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x43e942
push edi
call fcn.004300a2
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x420a49
push 0x4460f6
push esi
call fcn.004315b6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004084b8
leave
ret
Function at 0x42d9f0
Capabilities:
Connect to http server

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp - 4], esi
je 0x42da20
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x42da2d
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.004370c4
mov esi, eax
xor edx, edx
cmp esi, edx
jl 0x42db5c
mov edi, dword [ebp + 0x24]
cmp edi, edx
je 0x42da55
mov ecx, edi
cmp word [edi], dx
jne 0x42da58
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0x20]
cmp esi, edx
je 0x42da66
mov eax, esi
cmp word [esi], dx
jne 0x42da69
mov eax, dword [ebp - 0x18]
push edx
push edx
xor edx, edx
cmp dword [ebp - 0x24], 1
setne dl
lea edx, [edx + edx + 1]
push edx
push ecx
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
test ebx, ebx
je 0x42db6b
test esi, esi
je 0x42dad0
cmp word [esi], 0
je 0x42dad0
test edi, edi
je 0x42dad0
cmp word [edi], 0
je 0x42dad0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0x2b
push ebx
call esi
test eax, eax
je 0x42dad0
push dword [ebp + 0x24]
call edi
push eax
push dword [ebp + 0x24]
push 0x2c
push ebx
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp + 0x18]
push ebx
call fcn.0042d312
mov esi, eax
test esi, esi
js 0x42dba6
push dword [ebp + 0x30]
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042d830
mov esi, eax
test esi, esi
js 0x42dbb2
cmp dword [ebp - 8], 0
jne 0x42da0a
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
and dword [ebp - 4], ebx
mov ecx, edi
mov dword [eax], ecx
lea eax, [ebp - 0x24]
push eax
call fcn.00436e8e
cmp dword [ebp - 4], 0
je 0x42db48
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x42db53
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x2c
push 0x44c19e
push esi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x42db30
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42db7f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x42db8a
mov esi, 0x80004005
push esi
push 0x213
push 0x44bf4c
call fcn.004315ca
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c180
jmp 0x42dbbc
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c15e
jmp 0x42dbbc
mov eax, dword [ebp + 0x14]
push dword [eax]
push 0x44c13a
push esi
call fcn.004315b6
add esp, 0xc
jmp 0x42db30
Function at 0x42df00
Capabilities:
Create http request
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 0x10], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x18]
push ebx
push dword [edi]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0042fb3e
mov esi, eax
cmp esi, ebx
jge 0x42df57
push 0x44c360
push esi
call fcn.004315b6
pop ecx
pop ecx
jmp 0x42e0b1
push ebx
push ebx
push ebx
push ebx
push 0x44c356
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x42dfa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42df81
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x42df8c
mov esi, 0x80004005
push esi
push 0x93
push 0x44bf4c
call fcn.004315ca
push 0x44c336
jmp 0x42df4a
lea eax, [ebp - 0xc]
push eax
push 0x78
push 0x44c316
push 0x40314c
call fcn.00437126
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jbe 0x42dff5
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 6
push dword [ebp - 4]
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 5
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 8]
lea eax, [ebp - 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042dbca
mov esi, eax
cmp esi, ebx
jge 0x42e030
push dword [ebp - 8]
push 0x44c2ec
push esi
call fcn.004315b6
add esp, 0xc
jmp 0x42e0b1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x24]
lea esi, [ebp - 0x1c]
call fcn.0042d53e
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
push dword [edi + 8]
push dword [edi + 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0042dc8a
mov esi, eax
cmp esi, ebx
jge 0x42e08f
push dword [ebp - 8]
push 0x44c2d0
push esi
call fcn.004315b6
add esp, 0xc
jmp 0x42e0a2
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x42e0a2
cmp word [eax], bx
je 0x42e0a2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0xffffffff
je 0x42e0b1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x42e0be
push dword [ebp - 0x14]
call fcn.0042ecb2
cmp dword [ebp - 4], ebx
je 0x42e0cc
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], ebx
je 0x42e0d9
push dword [ebp - 8]
call fcn.0042ecb2
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0x42ea0c
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00408740
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
jne 0x42ea42
mov eax, 0x43b9c2
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x43f51a
push eax
call fcn.004300a2
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x42eac2
mov ax, word [ebp + 0x10]
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42eab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42ea9a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x42eaa5
mov edi, 0x80004005
push edi
push 0xa6
push 0x44c7de
call fcn.004315ca
jmp 0x42eac2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x42ead5
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x42eae2
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x42eaef
push dword [ebp - 4]
call fcn.0042ecb2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x434c3a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
and dword [ebp - 4], edi
xor esi, esi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434c82
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434c7c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x434c8c
add esi, dword [ebp - 4]
cmp esi, dword [ebp + 0x10]
jb 0x434c49
jmp 0x434c9c
push edi
push 0x34e
push 0x44cdd2
call fcn.004315ca
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x434ca4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0xf98]
mov eax, 0x1018
call fcn.0040b8e0
mov eax, dword [0x44f9f8]
xor eax, ebp
mov dword [ebp + 0xf94], eax
mov eax, dword [ebp + 0xfa0]
push ebx
mov ebx, dword [ebp + 0xfb0]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa4]
xor esi, esi
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], esi
xor edi, edi
mov ecx, dword [ebp + 0xfa8]
xor edx, edx
cmp ecx, edx
jne 0x434d04
cmp dword [ebp + 0xfac], edx
jne 0x434d04
mov dword [ebp - 0x74], 0x1000
jmp 0x434d2c
mov eax, dword [ebp + 0xfac]
sub ecx, edi
sbb eax, esi
cmp eax, edx
jb 0x434d26
ja 0x434d1c
cmp ecx, 0x1000
jbe 0x434d26
mov ecx, 0x1000
mov dword [ebp - 0x74], edx
jmp 0x434d29
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x74], ecx
push edx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x434da9
cmp dword [ebp - 0x74], 0
je 0x434d61
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x80]
call fcn.00434c3a
mov dword [ebp - 0x70], eax
test eax, eax
js 0x434d8c
add edi, dword [ebp - 0x74]
adc esi, 0
cmp esi, dword [ebp + 0xfac]
ja 0x434d83
jb 0x434d79
cmp edi, dword [ebp + 0xfa8]
jae 0x434d83
cmp dword [ebp - 0x74], 0
jne 0x434ce7
test ebx, ebx
je 0x434d8c
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov ecx, dword [ebp + 0xf94]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004084b8
add ebp, 0xf98
leave
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434dbd
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x70], eax
test eax, eax
jl 0x434dcb
mov dword [ebp - 0x70], 0x80004005
push dword [ebp - 0x70]
push 0x36e
push 0x44cdd2
call fcn.004315ca
jmp 0x434d8c
Function at 0x434de0
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], esi
sete al
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434e29
cmp eax, 0x50
je 0x434e21
cmp eax, 0xb7
jne 0x434e29
xor edi, edi
inc edi
jmp 0x434ebb
cmp eax, 3
jne 0x434eab
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434ea4
cmp ax, 0x5c
jne 0x434e40
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434e38
test esi, esi
je 0x434ea4
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.004357ec
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x434ebb
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x434ebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434e8c
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x434ebb
push edi
push 0x3b3
push 0x44cdd2
call fcn.004315ca
jmp 0x434ebb
mov edi, 0x80070003
jmp 0x434ebb
cmp eax, esi
jle 0x434eb9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x434f18
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x10], esi
je 0x434f34
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], esi
je 0x434f3d
or dword [ebp - 4], 2
push dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x435006
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x10], esi
jne 0x434f74
cmp eax, 0x50
je 0x434f6c
cmp eax, 0xb7
jne 0x434f74
xor edi, edi
inc edi
jmp 0x435006
cmp eax, 3
jne 0x434ff6
movzx eax, word [ebx]
mov ecx, ebx
test ax, ax
je 0x434fef
cmp ax, 0x5c
jne 0x434f8b
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x434f83
test esi, esi
je 0x434fef
xor eax, eax
push eax
push ebx
mov word [esi], ax
call fcn.004357ec
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
js 0x435006
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x435006
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x434fd7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jns 0x435006
push edi
push 0x426
push 0x44cdd2
call fcn.004315ca
jmp 0x435006
mov edi, 0x80070003
jmp 0x435006
cmp eax, esi
jle 0x435004
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10