joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433ff4
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4341c6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x4341c6
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [ebp - 4], esi
cmp eax, esi
je 0x43406a
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi + 0xc]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43405b
call fcn.0043506f
mov dword [ebp - 4], eax
jmp 0x43406a
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0xc]
je 0x43406a
mov dword [ebp - 4], 0x80047839
cmp dword [ebp - 4], esi
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
jl 0x4341ce
jmp 0x43407c
xor esi, esi
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x4341ce
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0x10]
test esi, esi
jle 0x43419b
mov eax, dword [edi + 8]
cmp eax, 0x4acec8
je 0x43413c
cmp eax, 0x4acecc
je 0x434149
xor eax, eax
lea esi, [ebx + esi*2]
movzx edi, word [esi]
mov word [esi], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
neg eax
sbb eax, eax
and eax, 0xfde9
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.00434f97
add esp, 0xc
mov dword [ebp - 4], eax
mov word [esi], di
test eax, eax
jl 0x434121
push dword [ebp - 0xc]
call fcn.004505e0
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43410c
call fcn.0043506f
mov dword [ebp - 4], eax
jmp 0x434118
cmp dword [ebp - 8], esi
je 0x434118
mov dword [ebp - 4], 0x8004783b
push dword [ebp - 0xc]
call fcn.0044fdab
pop ecx
mov edi, dword [ebp + 8]
cmp dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
jge 0x43407a
jmp 0x4341ce
mov eax, ebx
mov ecx, esi
rol word [eax], 8
inc eax
inc eax
dec ecx
jne 0x434140
lea eax, [esi + esi]
cmp eax, esi
jge 0x434159
mov dword [ebp - 4], 0x8004783c
jmp 0x434187
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x434178
call fcn.0043506f
mov dword [ebp - 4], eax
jmp 0x434187
lea eax, [esi + esi]
cmp dword [ebp - 8], eax
je 0x434187
mov dword [ebp - 4], 0x8004783a
cmp dword [edi + 8], 0x4acec8
jne 0x434124
rol word [ebx], 8
inc ebx
inc ebx
dec esi
jne 0x434190
jmp 0x434124
lea ecx, [ebp - 0x14]
call fcn.00476b94
push 1
push 2
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
call fcn.00476ce2
lea ecx, [ebp - 0x14]
call fcn.00476ad6
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4341bd
call fcn.0043506f
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4341d8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 0xc], esi
jne 0x434211
lea ecx, [ebp - 8]
call fcn.00476b94
push 1
push 2
push esi
push esi
push esi
push esi
lea ecx, [ebp - 8]
call fcn.00476ce2
lea ecx, [ebp - 8]
call fcn.00476ad6
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x434208
push esi
mov ebx, 0x8000080
push ebx
push 4
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 0x40000000
push edi
push dword [ebp + 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x434262
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push eax
push ebx
push 4
push eax
push eax
push edi
push dword [ebp + 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x434262
call fcn.0043506f
mov esi, eax
jmp 0x434278
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00433ff4
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x435cb6
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp dword [0x4c6594], 0
push esi
jne 0x435c29
call fcn.00435b4f
test eax, eax
je 0x435c6c
mov eax, dword [0x4c6594]
cmp eax, 1
jne 0x435c4a
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x435c6c
pop esi
ret
push eax
call dword [0x4c659c]
test eax, eax
jne 0x435cb4
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x435c70
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4c6594]
call dword [0x4c659c]
mov edi, eax
test edi, edi
je 0x435c95
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x435cb1
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4c6594]
call dword [fcn.004c6598]
add edi, 0x10
cmp edi, esi
jb 0x435c9d
mov eax, edi
pop edi
pop esi
ret
jmp 0x435c16
Function at 0x4387e2
Capabilities:
Write file on windows

Disassembly:
push 0x10
mov eax, 0x499ac1
call fcn.00454d31
mov esi, ecx
mov eax, dword [esi + 0x34]
cmp eax, 0xffffffff
je 0x438803
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 0x34], 0xffffffff
push 0x4c6540
lea ecx, [ebp - 0x14]
call fcn.0040cc78
lea eax, [esi + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040141e
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00436af6
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x4ac19c
push eax
call fcn.004011d3
add esp, 0xc
cmp dword [esi + 0x18], edi
je 0x438860
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x14]
push 0x4a3584
push eax
call fcn.004011d3
add esp, 0xc
push 0x4b04f0
lea ecx, [ebp - 0x14]
call fcn.0040cdda
mov ebx, dword [ebp - 0x14]
push edi
push 0x80
push 4
push edi
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x34], eax
cmp eax, 0xffffffff
je 0x4388c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4388b7
push edi
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0x34]
mov dword [ebp - 0x1c], 0xfeff
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push edi
push edi
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
cmp dword [esi + 0x34], 0xffffffff
lea ecx, [ebx - 0x10]
setne al
mov esi, eax
call fcn.00401395
mov eax, esi
jmp 0x4388ee
call fcn.00454dd6
ret

Function at 0x43a665
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push edi
mov edi, ecx
cmp ebx, eax
je 0x43a6b6
cmp dword [esi], eax
jne 0x43a6b6
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43a6aa
test byte [eax + 0x1c], 1
je 0x43a6aa
cmp byte [eax + 0x19], 2
jb 0x43a6aa
push 0x4a3608
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
mov dword [edi + 8], 0x57
jmp 0x43a750
push esi
push ebx
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 8], eax
test eax, eax
jne 0x43a750
inc eax
cmp dword [ebp + 0xc], eax
je 0x43a707
cmp dword [ebp + 0xc], 2
je 0x43a707
cmp dword [ebp + 0xc], 7
je 0x43a707
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43a749
test byte [ecx + 0x1c], al
je 0x43a749
cmp byte [ecx + 0x19], 2
jb 0x43a749
push 0x4a3608
push 0x17
jmp 0x43a73b
mov ecx, dword [esi]
test al, cl
jne 0x43a71b
test ebx, ebx
je 0x43a752
shr ecx, 1
cmp word [ebx + ecx*2 - 2], 0
je 0x43a752
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43a749
test byte [ecx + 0x1c], al
je 0x43a749
cmp byte [ecx + 0x19], 2
jb 0x43a749
push 0x4a3608
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0042524a
add esp, 0x10
mov dword [edi + 8], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x43a759
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esi + 8], eax
test eax, eax
je 0x43a790
xor eax, eax
jmp 0x43a7cf
cmp dword [ebp - 4], 4
je 0x43a7cc
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43a7c3
test byte [eax + 0x1c], 1
je 0x43a7c3
cmp byte [eax + 0x19], 2
jb 0x43a7c3
push 0x4a3608
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x43a78c
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x43ab8f
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
pop esi
mov eax, ecx
ret 8

Function at 0x43ad49
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x499cb9
call fcn.00454d9d
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ecx
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x40], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x3c]
push ecx
push eax
push ebx
push dword [esi + 4]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x43ad8f
xor eax, eax
jmp 0x43af80
cmp dword [ebp - 0x3c], 1
je 0x43add1
cmp dword [ebp - 0x3c], 2
je 0x43add1
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43adc8
test byte [eax + 0x1c], 1
je 0x43adc8
cmp byte [eax + 0x19], 2
jb 0x43adc8
push 0x4a3608
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
mov dword [esi + 8], 0xd
jmp 0x43ad88
test byte [ebp - 0x38], 1
je 0x43adf8
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43adc8
test byte [eax + 0x1c], 1
je 0x43adc8
cmp byte [eax + 0x19], 2
jb 0x43adc8
push 0x4a3608
push 0x1a
jmp 0x43adba
lea ecx, [ebp - 0x68]
call fcn.0043d9d0
mov eax, dword [ebp - 0x38]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x40]
inc eax
inc eax
mov dword [ebp - 0x38], eax
shr eax, 1
push eax
mov byte [ebp - 4], 1
call fcn.0043ad28
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
push dword [esi + 4]
call edi
mov ecx, dword [ebp - 0x40]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.0040859a
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43af59
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43ae72
test byte [eax + 0x1c], 1
je 0x43ae72
cmp byte [eax + 0x19], 2
jb 0x43ae72
push ecx
push 0x4a3608
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
mov ecx, dword [ebp - 0x40]
call fcn.00401537
jmp 0x43af59
lea ecx, [ebp - 0x68]
call fcn.0043d9a3
test al, al
je 0x43af6c
mov dword [esi + 8], 0xe
xor eax, eax
cmp dword [esi + 8], eax
lea ecx, [ebp - 0x68]
sete al
mov esi, eax
call fcn.0043d9b0
mov eax, esi
call fcn.00454df9
ret 8
Function at 0x43b08c
Capabilities:
Get system information on windows

Disassembly:
cmp byte [0x4c6958], 0
jne 0x43b130
push esi
push edi
mov edi, 0x11c
push edi
push 0
mov esi, 0x4c6810
push esi
call fcn.004501b0
add esp, 0xc
mov dword [0x4c6810], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
call edi
test eax, eax
jne 0x43b10e
push esi
mov dword [0x4c6810], 0x114
call edi
test eax, eax
jne 0x43b10e
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43b10e
test byte [eax + 0x1c], 1
je 0x43b10e
cmp byte [eax + 0x19], 2
jb 0x43b10e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x4c6094]
push 0x4a3654
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00425267
add esp, 0x14
push 0x24
push 0
mov esi, 0x4c692c
push esi
call fcn.004501b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop edi
mov byte [0x4c6958], 1
pop esi
mov al, 1
ret
Function at 0x43b9b7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.0044e85d
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43b9ed
cmp dword [ebp - 4], edi
jne 0x43b9ed
xor eax, eax
inc eax
jmp 0x43ba28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43ba26
test byte [ecx + 0x1c], 1
je 0x43ba26
cmp byte [ecx + 0x19], 2
jb 0x43ba26
push eax
push 0x4a3708
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00425267
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x43ba2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 4]
call fcn.0044e85d
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43ba64
cmp dword [ebp - 4], edi
jne 0x43ba64
xor eax, eax
inc eax
jmp 0x43ba9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43ba9d
test byte [ecx + 0x1c], 1
je 0x43ba9d
cmp byte [ecx + 0x19], 2
jb 0x43ba9d
push eax
push 0x4a3708
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00425267
add esp, 0x14
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x43bac7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
and dword [esi + 4], 0
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 4]
call fcn.0044e85d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x43bb36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0xc], eax
test eax, eax
je 0x43bb36
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43bb32
test byte [ecx + 0x1c], 1
je 0x43bb32
cmp byte [ecx + 0x19], 2
jb 0x43bb32
push eax
push 0x4a3708
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00425267
add esp, 0x14
xor eax, eax
jmp 0x43bb44
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4

Function at 0x43bd35
Capabilities:
Clear file content

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [esp + 0xc]
call fcn.0043bbd8
test eax, eax
je 0x43bd61
lea ecx, [esi + 4]
call fcn.0044e85d
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x43bd61
xor eax, eax
inc eax
jmp 0x43bd9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xc], eax
mov ecx, dword [0x4c6094]
cmp ecx, 0x4c6094
je 0x43bd9a
test byte [ecx + 0x1c], 1
je 0x43bd9a
cmp byte [ecx + 0x19], 2
jb 0x43bd9a
push eax
push 0x4a3708
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00425267
add esp, 0x14
xor eax, eax
pop esi
ret 8
Function at 0x43bdbc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0x74
mov eax, 0x499ce6
call fcn.00454d9d
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x60]
call fcn.0043d9d0
and dword [ebp - 4], 0
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
inc eax
push eax
lea ecx, [ebp - 0x78]
call fcn.0040cb9a
push 0
lea ecx, [ebp - 0x78]
call fcn.0040cbd7
mov edi, eax
push esi
push edi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x43be27
push edi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
push eax
push edi
call dword [sym.imp.USER32.dll_CharPrevW]
jmp 0x43be31
push 0x5c
push edi
call fcn.0044fd34
pop ecx
pop ecx
xor ebx, ebx
inc ebx
mov edi, 0x4c6094
mov esi, 0x4a3708
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x43bfaf
test ebx, ebx
je 0x43bfaf
push dword [ebp - 0x38]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43bf5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43befa
cmp eax, 3
je 0x43befa
cmp eax, 5
jne 0x43becb
mov eax, dword [0x4c6094]
cmp eax, edi
je 0x43beac
test byte [eax + 0x1c], 1
je 0x43beac
cmp byte [eax + 0x19], 3
jb 0x43beac
push 5
push dword [ebp - 0x38]
push esi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00444114
add esp, 0x18
mov eax, dword [ebp - 0x3c]
push 0x5c
pop ecx
push eax
mov word [eax], cx
call dword [sym.imp.USER32.dll_CharNextW]
push 0x5c
push eax
call fcn.0044fd34
pop ecx
pop ecx
jmp 0x43be3e
mov ecx, dword [0x4c6094]
cmp ecx, edi
je 0x43bef6
test byte [ecx + 0x1c], 1
je 0x43bef6
cmp byte [ecx + 0x19], 2
jb 0x43bef6
push eax
push dword [ebp - 0x38]
push esi
push 0x19
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00444114
add esp, 0x18
xor ebx, ebx
jmp 0x43beac
push 0
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
jne 0x43beac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c6094]
cmp ecx, edi
je 0x43bf3c
test byte [ecx + 0x1c], 1
je 0x43bf3c
cmp byte [ecx + 0x19], 2
jb 0x43bf3c
push eax
push dword [ebp - 0x38]
push esi
push 0x17
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00444114
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.00421c94
push dword [ebp - 0x78]
call fcn.0044fc83
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0043d9b0
xor eax, eax
call fcn.00454df9
ret
test al, 0x10
jne 0x43beac
mov ecx, dword [0x4c6094]
cmp ecx, edi
je 0x43bf90
test byte [ecx + 0x1c], 1
je 0x43bf90
cmp byte [ecx + 0x19], 2
jb 0x43bf90
push eax
push dword [ebp - 0x38]
push esi
push 0x1a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00444114
add esp, 0x18
lea ecx, [ebp - 0x78]
call fcn.00421c94
push dword [ebp - 0x78]
call fcn.0044fc83
xor esi, esi
pop ecx
lea ecx, [ebp - 0x60]
call fcn.0043d9b0
mov eax, esi
jmp 0x43bf57
lea ecx, [ebp - 0x78]
call fcn.00421c94
push dword [ebp - 0x78]
call fcn.0044fc83
mov esi, ebx
jmp 0x43bfa2
Function at 0x43cd86
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43cf1c
test esi, esi
je 0x43cf1c
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x64
jb 0x43cf1c
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004501b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43ce01
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43cf1f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x43cf07
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x43cf07
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00450bf8
add esp, 0xc
test eax, eax
jne 0x43cf00
push 0x4a38fc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43cf00
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43ce01
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x4a38c4
push 0x4a38b4
push 0x4a38a0
call fcn.0043ca94
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x43cea3
push 0x7a
jmp 0x43cf1e
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43cecf
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43cef2
cmp eax, 5
jne 0x43cee1
push 0x4a3808
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x43cef2
cmp eax, 2
jne 0x43ceed
push 0x4a3770
jmp 0x43ced9
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x43cf1f
mov eax, 0x54f
jmp 0x43cf1f
push 0x1c
push 0x4a38c4
push ebx
push esi
call fcn.00450ac4
add esp, 0x10
xor eax, eax
jmp 0x43cf1f
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fc8e
leave
ret
Function at 0x43cf2e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43d06c
test esi, esi
je 0x43d06c
mov ebx, dword [ebp + 0x10]
cmp ebx, 0x26
jb 0x43d06c
xor eax, eax
push 0x208
push eax
mov word [esi], ax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004501b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43cfa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43d06f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x43d068
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCServerW]
test eax, eax
jne 0x43d068
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push 0x105
push eax
call fcn.00450bf8
add esp, 0xc
test eax, eax
jne 0x43d061
push 0x4a38fc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x43d061
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43cfa9
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x4af248
push 0x4a3914
push 0x4a38a0
call fcn.0043ca94
add esp, 0x18
dec ebx
cmp eax, ebx
jne 0x43d043
push 0x7a
jmp 0x43d06e
push esi
call fcn.0043c16a
pop ecx
test al, al
jne 0x43d053
xor eax, eax
mov word [esi], ax
xor eax, eax
cmp word [esi], ax
setne al
dec eax
and eax, 0xd
jmp 0x43d06f
mov eax, 0x54f
jmp 0x43d06f
push 2
jmp 0x43d06e
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044fc8e
leave
ret
Function at 0x43d2c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
call fcn.0043d0fa
pop ecx
test al, al
je 0x43d3ac
push edi
push 0xffffffffffffffff
push 0x4c69b4
lea ecx, [ebp - 0x74]
call fcn.00446ad9
mov eax, dword [0x4c69dc]
cmp dword [eax - 0xc], edi
je 0x43d30f
mov esi, eax
lea ecx, [ebp - 0x74]
call fcn.00437b63
mov eax, esi
jmp 0x43d3db
xor eax, eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push edi
push eax
call fcn.004501b0
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x400000
call fcn.0043d07e
add esp, 0x18
test eax, eax
je 0x43d33c
xor esi, esi
jmp 0x43d300
push ebx
mov esi, 0x4c69dc
push 0x105
mov ecx, esi
call fcn.0040136b
push edi
push 0x1c
mov ebx, eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x43d384
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
test eax, eax
je 0x43d382
push dword [0x4c69d4]
push ebx
call edi
test eax, eax
je 0x43d382
xor edi, edi
inc edi
jmp 0x43d384
xor edi, edi
push 0xffffffffffffffff
mov ecx, esi
call fcn.0040859a
pop ebx
test edi, edi
je 0x43d39d
mov esi, dword [0x4c69dc]
jmp 0x43d300
mov ecx, esi
call fcn.00401537
lea ecx, [ebp - 0x74]
call fcn.00437b63
mov eax, dword [0x4c6094]
cmp eax, 0x4c6094
je 0x43d3d9
test byte [eax + 0x1c], 1
je 0x43d3d9
cmp byte [eax + 0x19], 2
jb 0x43d3d9
push 0x4a3754
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0042524a
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044fc8e
leave
ret