joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422e0a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov ecx, dword [0x465b20]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x422f6b
cmp byte [eax], bl
je 0x422f6b
mov esi, 0x105
push esi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00438c79
lea eax, [ebp - 0x120]
push eax
call fcn.00455c50
add esp, 0x10
cmp byte [ebp + eax - 0x121], 0x5c
je 0x422e98
lea ecx, [eax + 1]
cmp ecx, esi
jae 0x422f6b
mov byte [ebp + eax - 0x120], 0x5c
mov byte [ebp + eax - 0x11f], bl
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4687d8], 1
jne 0x422eca
or dword [0x4687d8], edi
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4687d4], eax
mov eax, dword [0x4687d4]
cmp eax, ebx
je 0x422f0c
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push ecx
call eax
test eax, eax
je 0x422f6b
cmp byte [ebp + 0xc], bl
je 0x422ef9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
jmp 0x422eff
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, ecx
mov edi, eax
jmp 0x422f47
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x422f6b
cmp byte [ebp + 0xc], bl
mov eax, dword [ebp + 8]
jne 0x422f38
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 4]
imul eax, dword [ebp - 0xc]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x465b20]
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push esi
call fcn.00401928
jmp 0x422f6d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4231fa
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
push 0
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
mov ecx, dword [0x465b20]
mov ebx, 0x459f14
push ebx
call fcn.00401592
mov esi, dword [ebp + 8]
test esi, esi
je 0x423253
cmp byte [esi], 0
je 0x423253
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42325c
test al, 0x10
je 0x423253
mov ecx, dword [0x465b20]
push edi
push 0
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
push 0x5c
push esi
call fcn.00456490
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4232ba
push esi
call fcn.00455c50
cmp eax, 0x104
pop ecx
jae 0x4232b5
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00438c79
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.004231fa
cmp byte [edi + 1], 0
je 0x4232b5
mov ecx, dword [0x465b20]
call fcn.00401d39
cmp byte [eax], 0x31
jne 0x4232ba
xor eax, eax
inc eax
jmp 0x423255
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4232cc
mov ebx, 0x45871c
mov ecx, dword [0x465b20]
push 1
push 0
push 0xffffffffffffffff
push ebx
call fcn.00401592
jmp 0x423255
Function at 0x4232e3
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push ebx
push esi
mov esi, dword [0x467fa0]
push edi
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
cmp byte [esi], bl
je 0x423355
push 0x45ce5c
push esi
call fcn.00438f35
test eax, eax
pop ecx
pop ecx
jne 0x423345
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x423355
mov ecx, dword [0x465b20]
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
jmp 0x423355
push 1
mov ecx, edi
call fcn.0041c5f5
cmp eax, 0x104
jb 0x42335d
xor eax, eax
inc eax
jmp 0x423471
lea eax, [ebp - 0x26c]
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42337c
push ebx
jmp 0x423466
lea eax, [ebp - 0x12c]
push esi
push eax
call fcn.00455a20
lea eax, [ebp - 0x12c]
push 0x5c
push eax
call fcn.00456490
add esp, 0x10
cmp eax, ebx
je 0x4233b0
mov byte [eax + 1], bl
lea eax, [ebp - 0x12c]
push eax
call fcn.00455c50
pop ecx
jmp 0x4233b8
mov byte [ebp - 0x12c], bl
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp + eax - 0x12c]
mov esi, 0x103
mov dword [ebp - 0xc], ecx
sub esi, eax
call edi
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x423403
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4233fc
push 1
push 0xffffffffffffffff
call fcn.0040b5c4
pop ecx
pop ecx
call edi
mov dword [0x466154], eax
test byte [ebp - 0x26c], 0x10
jne 0x423442
lea eax, [ebp - 0x240]
push eax
call fcn.00455c50
cmp eax, esi
pop ecx
ja 0x42343f
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0xc]
call fcn.00455a20
pop ecx
pop ecx
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x423442
inc dword [ebp - 4]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4233cf
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 4]
mov ecx, dword [0x465b20]
call fcn.004018c8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423476
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov ecx, dword [0x465b20]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push edi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x4234f8
cmp byte [eax], bl
je 0x4234f8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4234f8
mov ecx, dword [0x465b20]
push edi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
call fcn.0043948b
pop ecx
pop ecx
mov ecx, dword [0x467ff0]
push eax
call fcn.00401592
jmp 0x4234fa
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x423a65
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.004561f0
mov eax, dword [0x467ff0]
mov ecx, dword [0x465b20]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
mov dword [ebp - 0xc], eax
call fcn.00401592
push dword [ebp + 0xc]
call fcn.00401a7c
mov edi, edx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x14], eax
jg 0x423ab6
jl 0x423b90
cmp eax, esi
jb 0x423b90
push 0x45b054
push dword [ebp + 8]
call fcn.0043df32
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
je 0x423b90
cmp edi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jl 0x423b50
jg 0x423ae1
cmp dword [ebp - 0x14], ebx
jbe 0x423b50
push dword [ebp + 0xc]
lea eax, [ebp - 0x10030]
push 0xffff
push eax
call fcn.0043deb1
add esp, 0xc
test eax, eax
je 0x423b87
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x423b3b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x423b30
push esi
push 0xffffffffffffffff
call fcn.0040b5c4
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x466154], eax
add dword [ebp - 8], esi
adc dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jl 0x423ae1
jg 0x423b50
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x423ae1
push dword [ebp + 0xc]
call fcn.0043ddba
lea eax, [ebp - 0x10030]
push eax
call fcn.00455c50
cmp eax, ebx
pop ecx
pop ecx
je 0x423b80
cmp byte [ebp + eax - 0x10031], 0xa
jne 0x423b7c
dec eax
mov byte [ebp + eax - 0x10030], bl
cmp eax, ebx
jne 0x423b94
push esi
push ebx
push 0xffffffffffffffff
push ebx
jmp 0x423b9e
push dword [ebp + 0xc]
call fcn.0043ddba
pop ecx
mov eax, esi
jmp 0x423bbe
push esi
push ebx
push eax
lea eax, [ebp - 0x10030]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401592
test eax, eax
je 0x423bbe
mov ecx, dword [0x465b20]
push esi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424fb5
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [0x467ff0]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.00413156
add esp, 0x14
cmp al, bl
mov byte [ebp - 4], al
jne 0x425032
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0042247e
add esp, 0xc
cmp eax, ebx
jne 0x425006
push 1
push ebx
push 0xffffffffffffffff
push 0x4585d8
jmp 0x425074
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x14], ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push eax
call fcn.0041e843
fstp st(0)
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004017f3
jmp 0x42507b
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.00441c9f
cmp eax, 0x50
pop ecx
je 0x425052
cmp eax, 0x54
je 0x42504d
xor eax, eax
jmp 0x425055
push 2
pop eax
jmp 0x425055
xor eax, eax
inc eax
push eax
push dword [ebp - 4]
call fcn.0041ec15
pop ecx
test al, al
pop ecx
mov eax, 0x45d47c
jne 0x42506e
mov eax, 0x45d478
push 1
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00401592
pop esi
pop ebx
leave
ret 8
Function at 0x42ad06
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov ecx, dword [0x465b20]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x45e834
push edi
push ebx
push 0x45e844
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42ae6a
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x42ad6c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov ecx, dword [ebp + 0x14]
cmp byte [ecx], bl
je 0x42ad7d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x18]
cmp byte [ecx], bl
je 0x42ad8e
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
push esi
mov esi, dword [ebp + 0x1c]
cmp byte [esi], bl
je 0x42adb4
mov eax, dword [ebp + 0x24]
cmp byte [eax], bl
je 0x42ada7
push eax
call fcn.004019fa
pop ecx
dec eax
jmp 0x42ada9
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push esi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp + 0x20]
cmp byte [esi], bl
je 0x42ade6
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push ebx
push ebx
push esi
call fcn.00413156
add esp, 0x14
cmp al, bl
je 0x42ade6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
movzx ax, al
or eax, 0x600
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [ebp + 0x28]
cmp byte [eax], bl
je 0x42ae00
mov ecx, dword [ebp - 4]
mov esi, dword [ecx]
push eax
call fcn.004019fa
pop ecx
push eax
push dword [ebp - 4]
call dword [esi + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x45e864
push eax
call dword [ecx]
test eax, eax
pop esi
jl 0x42ae61
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x42ae58
mov ecx, dword [0x465b20]
push edi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop ebx
leave
ret 0x24
Function at 0x42b169
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov ecx, dword [0x465b20]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x459f14
call fcn.00401592
mov ecx, dword [0x467ff0]
push esi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.00401592
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x42b26a
cmp byte [edi], bl
je 0x42b26a
lea eax, [ebp - 8]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x42b26a
push eax
call fcn.0043ea34
pop ecx
mov esi, eax
push esi
push dword [ebp + 8]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x45aac4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x42b1fd
push esi
call fcn.0043dff1
xor eax, eax
pop ecx
inc eax
jmp 0x42b26c
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edi, ecx
mov edx, 0xffff
and edi, edx
push edi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
lea eax, [ebp - 0x8c]
push 0x80
push eax
call fcn.00409c5f
push esi
call fcn.0043dff1
mov ecx, dword [0x465b20]
add esp, 0x20
push 1
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov ecx, dword [0x467ff0]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x8c]
push eax
call fcn.00401592
jmp 0x42b26c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42b273
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42b2f2
cmp byte [eax], bl
je 0x42b2f2
lea ecx, [ebp - 0x128]
push ecx
push eax
call fcn.0042b85b
lea eax, [ebp - 0x128]
push eax
call fcn.00455c50
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov eax, 0x459f14
jne 0x42b2ea
mov eax, 0x45871c
push 1
push ebx
push 0xffffffffffffffff
push eax
jmp 0x42b2fc
push 1
push ebx
push 0xffffffffffffffff
push 0x459f14
mov ecx, dword [0x465b20]
call fcn.00401592
pop ebx
leave
ret 4
Function at 0x42b8a0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b85b
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 0xc]
call fcn.0042b85b
lea eax, [ebp - 0x128]
push eax
call fcn.0042bef4
add esp, 0x14
test al, al
je 0x42b902
lea eax, [ebp - 0x230]
push eax
call fcn.0042bef4
test al, al
pop ecx
je 0x42b8f1
cmp byte [ebp + 0x10], 0
jmp 0x42b900
lea eax, [ebp - 0x230]
push eax
call fcn.0042bb98
pop ecx
test al, al
jne 0x42b906
xor al, al
leave
ret
push edi
lea eax, [ebp - 0x128]
push str..
push eax
call fcn.00455a30
lea eax, [ebp - 0x128]
push eax
call fcn.00455c50
mov byte [ebp + eax - 0x127], 0
lea eax, [ebp - 0x230]
push eax
call fcn.00455c50
and dword [ebp - 0x20], 0
add esp, 0x10
mov byte [ebp + eax - 0x22f], 0
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop edi
leave
ret
Function at 0x42b984
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
push esi
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 8]
call fcn.0042b85b
lea eax, [ebp - 0x584]
push eax
push dword [ebp + 0xc]
call fcn.0042b85b
lea eax, [ebp - 0x234]
push eax
call fcn.0042bef4
add esp, 0x14
test al, al
mov esi, str..
je 0x42b9d3
lea eax, [ebp - 0x234]
push esi
push eax
call fcn.00455a30
pop ecx
pop ecx
lea eax, [ebp - 0x584]
push eax
call fcn.0042bef4
test al, al
pop ecx
je 0x42b9f3
lea eax, [ebp - 0x584]
push esi
push eax
call fcn.00455a30
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42ba16
xor eax, eax
jmp 0x42bb95
push ebx
push edi
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00441067
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x794]
push eax
push str._s_s
lea eax, [ebp - 0x12c]
push 0x105
push eax
call fcn.00409c5f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, 0x104
add esp, 0x28
sub esi, eax
and dword [ebp - 4], 0
lea ebx, [ebp + eax - 0x12c]
call edi
sub eax, dword [0x466154]
cmp eax, dword [0x4651e4]
jbe 0x42bab5
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42baae
push 1
push 0xffffffffffffffff
call fcn.0040b5c4
pop ecx
pop ecx
call edi
mov dword [0x466154], eax
test byte [ebp - 0x47c], 0x10
jne 0x42bb6f
lea eax, [ebp - 0x450]
push eax
call fcn.00455c50
cmp eax, esi
pop ecx
ja 0x42bb6c
lea eax, [ebp - 0x450]
push eax
push ebx
call fcn.00455a20
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0042bc74
add esp, 0x14
cmp byte [ebp + 0x14], 0
je 0x42bb4b
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x42bb6f
cmp byte [ebp + 0x10], al
je 0x42bb6c
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x42bb6c
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x42bb68
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x42bb6f
inc dword [ebp - 4]
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42ba7f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42bb98
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42bc08
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
dec eax
je 0x42bbf8
dec eax
jne 0x42bc10
push edi
call fcn.00455c50
cmp eax, 0x104
pop ecx
ja 0x42bc10
add eax, 4
and eax, 0xfffffffc
call fcn.004561f0
mov esi, esp
push edi
push esi
call fcn.00455a20
push 0x5c
push esi
call fcn.00456490
add esp, 0x10
test eax, eax
je 0x42bc10
push esi
mov byte [eax], 0
call fcn.0042bb98
test al, al
pop ecx
je 0x42bc10
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
jmp 0x42bc12
test al, 0x10
je 0x42bc10
mov al, 1
jmp 0x42bc12
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x42bc19
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
mov esi, dword [ebp + 8]
push 0x2a
push esi
call fcn.00455d80
test eax, eax
pop ecx
pop ecx
jne 0x42bc51
push 0x3f
push esi
call fcn.00455d80
test eax, eax
pop ecx
pop ecx
jne 0x42bc51
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x42bc71
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x42bc68
xor al, al
jmp 0x42bc71
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
leave
ret

Function at 0x42bef4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bf0b
test al, 0x10
je 0x42bf0b
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x42bf0e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b85b
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 0xc]
call fcn.0042b85b
lea eax, [ebp - 0x128]
push eax
call fcn.0042bef4
add esp, 0x14
test al, al
jne 0x42bf4a
leave
ret
push esi
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor esi, esi
inc esi
cmp eax, 0xffffffff
je 0x42bf76
test al, 0x10
je 0x42bf6f
cmp dword [ebp + 0x10], esi
je 0x42bf76
cmp dword [ebp + 0x10], 2
je 0x42bf76
xor al, al
jmp 0x42c02d
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0042be5a
test al, al
pop ecx
pop ecx
je 0x42bfbb
push esi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0042b8a0
add esp, 0xc
test al, al
je 0x42bf6f
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.0042c030
pop ecx
pop ecx
jmp 0x42c02d
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.00455c50
mov byte [ebp + eax - 0x127], 0
lea eax, [ebp - 0x230]
push eax
call fcn.00455c50
and dword [ebp - 0x20], 0
pop ecx
pop ecx
mov byte [ebp + eax - 0x22f], 0
push 6
xor eax, eax
cmp dword [ebp + 0x10], 2
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x10], 0x614
pop edi
jne 0x42c01e
mov word [ebp - 0x10], 0x615
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret

Function at 0x42c030
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b85b
lea eax, [ebp - 0x128]
push eax
call fcn.0042bef4
add esp, 0xc
test al, al
jne 0x42c05d
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x128]
push eax
jne 0x42c079
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne al
jmp 0x42c0ba
call fcn.00455c50
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop ebx
leave
ret