joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed5ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x4ed61a
mov eax, esi
call fcn.00483b98
test al, al
je 0x4ed61a
mov eax, dword [ebx + 0x88]
call fcn.004837ec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4ed61a
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x4ed60e
push 0
mov eax, dword [ebx + 0x88]
call fcn.004837ec
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.0047aa28
jmp 0x4ed61a
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.004ed3e4
pop esi
pop ebx
ret

Function at 0x513e2c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x513f54
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00513d18
mov eax, dword [esi]
call fcn.00408550
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x417b5c]
call fcn.00408704
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404710
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404710
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408550
mov dword [ebp - 0xc], eax
mov eax, dword [0x56c784]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.00504670
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404aa0
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408550
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.0050464c
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.00504450
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.00504668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513f5b
lea eax, [ebp - 4]
mov edx, dword [0x417b5c]
call fcn.00408710
ret
Function at 0x5576c8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00404aa0
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x100146b
Capabilities:
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1003010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x104
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x230], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10014c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001214
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
push esi
jmp 0x1001559
push 0x100111c
mov esi, 0x113
lea eax, [ebp - 0x22c]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
test ebx, ebx
je 0x10014ef
push ebx
lea eax, [ebp - 0x22c]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x100152a
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x100152a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push 0x10011ec
call sub.ntdll.dll_DbgPrint
add esp, 0xc
jmp 0x10014ba
mov esi, 0x10011dc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1001562
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push dword [ebp - 0x230]
push esi
push 0x10011ac
call sub.ntdll.dll_DbgPrint
add esp, 0x10
push ebx
push dword [edi]
call fcn.010013f6
jmp 0x100156d
push 0x10033b8
push edi
push dword [ebp + 0xc]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100184f
leave
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403203
pop dword [ebp - 0x38]
mov eax, 0xf753ba7d
add eax, 0x8ec7786
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x61c493e6
add dword [ebp - 0x48], 0xec8db165
mov dword [ebp - 0x44], 0x2d875f69
add dword [ebp - 0x44], 0x4abecdc
mov dword [ebp - 0x40], 0xadb988d3
add dword [ebp - 0x40], 0x9e92bb5b
mov dword [ebp - 0x3c], 0xbc17f0f5
add dword [ebp - 0x3c], 0x43e80f0b
lea eax, [ebp - 0x48]
push eax
mov eax, 0x35e30c52
sub eax, 0x35a28bc6
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x37686ef7
sub dword [ebp - 0x48], 0xc2f605a1
mov dword [ebp - 0x44], 0xc5f2f2cd
sub dword [ebp - 0x44], 0x84869158
mov dword [ebp - 0x40], 0x34062575
add dword [ebp - 0x40], 0x2f6946f7
mov dword [ebp - 0x3c], 0x6cfe6bc7
sub dword [ebp - 0x3c], 0x6cfe6bc7
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xcec82027
sub eax, 0xce879f53
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x32ed5
push 0
call eax
mov ecx, 0xfddf47d0
add ecx, 0x220f185
xor edi, edi
add edi, eax
mov ebx, 0xb696950a
sub ebx, 0xb655850a
add ebx, dword [ebp - 0x38]
mov esi, 0x742098a6
add esi, 0x83bc8b5e
mov dword [ebp - 0x28], 0x1c2df950
mov edx, dword [ebx]
add dword [ebp - 0x10], 0xe5aa2f4d
add edx, esi
xor dword [ebp - 0x30], 0xc08d3f69
mov dword [edi], edx
add dword [ebp - 0x18], edi
add edi, 4
add ebx, 0xca607f0f
sub ebx, 0xca607f0b
loop 0x403327
add eax, 0xc626f78
sub eax, 0xc619751
xor ebx, ebx
add ebx, eax
add eax, 0x3e2b4731
sub eax, 0x3e2b472c
mov ecx, 0xdd900fb
add ecx, 0xf266ff05
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4080e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
xor eax, eax
push ebx
push ebp
push esi
push edi
nop
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x46cfa0], ecx
inc eax
cmp eax, 0x100
jb 0x4080f0
cmp eax, 0x800
jae 0x4081c3
lea esp, [esp]
mov edx, dword [eax*4 + 0x46cba0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x46cfa0]
mov dword [eax*4 + 0x46cfa0], edx
inc eax
cmp eax, 0x800
jb 0x4081a0
lea ecx, [esp + 0x10]
mov dword [0x469c64], 0x44eff0
call fcn.004082f0
test eax, eax
je 0x40827b
mov edi, dword [esp + 0x20]
xor ecx, ecx
mov ebp, dword [esp + 0x18]
mov esi, edi
shr esi, 8
mov eax, 0x4655c8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
mov ebx, dword [esp + 0x14]
cmp dword [eax - 8], ebx
mov ebx, dword [esp + 0x1c]
jne 0x408219
cmp dword [eax - 4], ebp
jne 0x408219
cmp dword [eax], ebx
je 0x408228
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x408203
or ecx, 0xffffffff
sub ecx, 0
je 0x408262
dec ecx
je 0x408251
dec ecx
jne 0x40827b
cmp esi, 6
jb 0x40827b
jne 0x408271
cmp edi, 0xf
jb 0x40827b
mov dword [0x469c64], 0x44ef10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 5
jb 0x40827b
jne 0x408271
cmp edi, 6
jb 0x40827b
cmp edi, 0xa
jmp 0x40826f
cmp esi, 6
jb 0x40827b
jne 0x408271
cmp edi, 0x100c
je 0x40827b
mov dword [0x469c64], 0x44ef10
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410f08
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x464628]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push ebx
push esi
jb 0x410f25
mov ecx, dword [ecx]
xor ebx, ebx
xor eax, eax
push ebx
push 0x80
push 3
push ebx
inc eax
push eax
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410f4e
xor al, al
jmp 0x410fd1
push ebx
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], ebx
push eax
push 0x40
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x144], 0x40
jne 0x410fc8
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne 0x410fc8
push ebx
push ebx
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x410fc8
push ebx
lea eax, [ebp - 0x144]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x144], 0xf8
jne 0x410fc8
cmp dword [ebp - 0x140], 0x4550
push 1
movzx ebx, bl
pop ecx
cmove ebx, ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00437430
mov esp, ebp
pop ebp
ret

Function at 0x412089
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, ecx
mov bl, 1
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp + 8]
push edi
mov esi, dword [eax + 0xf8]
push ecx
lea ecx, [eax + 0xf8]
mov dword [ebp - 8], eax
call fcn.004146db
cmp dword [eax], esi
jne 0x412109
xor ebx, ebx
cmp dword [edi + 0x14], 8
jb 0x4120c2
mov eax, dword [edi]
jmp 0x4120c4
mov eax, edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4120db
mov ecx, edi
call fcn.00429e70
test al, al
je 0x412109
movzx eax, byte [0x469c62]
mov bl, 1
mov esi, dword [ebp - 8]
push eax
push edi
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xf8]
call fcn.00414b35
mov ecx, dword [esi + 0x100]
test ecx, ecx
je 0x412109
mov edx, dword [ecx]
push edi
call dword [edx + 0xc]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d45b
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edi, esi
push 8
shl edi, 0x18
pop ebx
lea ecx, [edi + edi]
mov edx, edi
mov eax, ecx
mov edi, ecx
xor eax, 0x4c11db7
and edx, 0x80000000
cmovne edi, eax
dec ebx
test ebx, ebx
jg 0x41d468
mov dword [esi*4 + 0x469700], edi
inc esi
cmp esi, 0x100
jb 0x41d460
pop edi
pop esi
pop ebx
ret
Function at 0x429040
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
jne 0x42904c
xor al, al
ret
and eax, 0xffffb1af
cmp dword [ecx + 0x14], 8
jb 0x429059
mov ecx, dword [ecx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x4299b0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4299dc
lea eax, [esi + 1]
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00437430
add esp, 8
ret 4
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x429a08
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x429a08
xor cl, cl
jmp 0x429a1a
mov ecx, dword [esp + 8]
xor eax, eax
add eax, edi
mov dword [esi], eax
adc ecx, 0
mov dword [esi + 4], ecx
mov cl, 1
xor eax, eax
test cl, cl
mov ecx, dword [esp + 0xc]
pop edi
sete al
pop esi
xor ecx, esp
call fcn.00437430
add esp, 8
ret 4

Function at 0x429a40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f90b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x34
call fcn.0043831d
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 0x30], 0
test esi, esi
je 0x429aac
push 0x34
push 0
push esi
call fcn.0043b1a0
add esp, 0xc
mov ecx, esi
call fcn.004295f0
mov esi, eax
jmp 0x429aae
xor esi, esi
mov dword [esp + 0x30], 0xffffffff
lea eax, [edi + 0xc]
push ecx
push 3
push 3
push 0x80000000
push eax
lea ecx, [esi + 0x18]
call fcn.0042bec0
test al, al
jne 0x429ae0
test esi, esi
je 0x429adc
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor eax, eax
jmp 0x429b39
push 1
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
push 0
push dword [edi + 8]
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
mov dword [esp + 0xc], ecx
cmp ecx, 0xffffffff
jne 0x429b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x429ad0
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
xorps xmm0, xmm0
push edx
push 0
push dword [esp + 0x18]
movlpd qword [esp + 0x20], xmm0
mov eax, dword [esi + 8]
push ecx
lea ecx, [esi + 8]
call dword [eax + 0x14]
test eax, eax
jne 0x429ad4
lea eax, [esi + 8]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00437430
mov esp, ebp
pop ebp
ret
Function at 0x429c80
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44f9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x1c], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.0040348d
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 0xc]
call fcn.004070c0
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x429d2f
push dword [esp + 0xc]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00437430
add esp, 0x2c
ret

Function at 0x429d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x18], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.0040348d
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 8]
call fcn.004070c0
cmp dword [esp + 0x1c], 8
lea eax, [esp + 8]
cmovae eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429e11
test al, 0x10
jne 0x429e11
mov bl, 1
jmp 0x429e13
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x429e2e
push dword [esp + 8]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
mov al, bl
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00437430
mov esp, ebp
pop ebp
ret
Function at 0x429e70
Capabilities:
Access peb ldr_data
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44f9a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x1c], 0
push 0xffffffffffffffff
push eax
push ecx
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.0040348d
mov dword [esp + 0x30], 0
mov edx, 0x24
lea ecx, [esp + 0xc]
call fcn.004070c0
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429f0b
test al, 0x10
je 0x429f0b
mov bl, 1
jmp 0x429f0d
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x429f28
push dword [esp + 0xc]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00437430
add esp, 0x2c
ret

Function at 0x429f60
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x44fa08
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esi + 0x10]
xor edi, edi
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test ebx, ebx
je 0x42a04b
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x429fb3
mov ecx, dword [esi]
jmp 0x429fb5
mov ecx, esi
mov edx, 0x2f
cmp dx, word [ecx + edi*2]
mov edx, 0x5c
je 0x429fd6
cmp eax, 8
jb 0x429fce
mov eax, dword [esi]
jmp 0x429fd0
mov eax, esi
cmp dx, word [eax + edi*2]
jne 0x42a042
push edi
push 0
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.004066d0
mov dword [esp + 0x38], 0
cmp dword [esp + 0x24], 0
je 0x42a014
lea ecx, [esp + 0x14]
call fcn.00429c80
test al, al
jne 0x42a014
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push 0
cmovae eax, dword [esp + 0x18]
push eax
call ebp
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x42a02f
push dword [esp + 0x14]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], eax
mov word [esp + 0x14], ax
inc edi
cmp edi, ebx
jb 0x429fa7
mov ecx, esi
call fcn.00429c80
test al, al
jne 0x42a067
cmp dword [esi + 0x14], 8
jb 0x42a060
mov eax, dword [esi]
jmp 0x42a062
mov eax, esi
push 0
push eax
call ebp
mov ecx, esi
call fcn.00429e70
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00437430
add esp, 0x28
ret
Function at 0x42a3c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fab1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x464628]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], 0
mov dword [esp + 0xc], 0
call fcn.0042a500
mov dword [esp + 0x38], 0
sub esp, 8
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 1
mov ecx, esi
mov dword [esp + 0x18], 0x2e
push eax
call fcn.004075a0
cmp eax, 0xffffffff
je 0x42a4e3
push eax
push 0
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.004066d0
mov edi, eax
mov dword [esp + 0x38], 1
cmp esi, edi
je 0x42a4b4
cmp dword [esi + 0x14], 8
jb 0x42a45d
push dword [esi]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp dword [edi + 0x14], 8
jae 0x42a48b
mov eax, dword [edi + 0x10]
inc eax
je 0x42a495
add eax, eax
push eax
push edi
push esi
call fcn.00437a90
add esp, 0xc
jmp 0x42a495
mov eax, dword [edi]
mov dword [esi], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov byte [esp + 0x38], 0
cmp dword [esp + 0x2c], 8
jb 0x42a4cc
push dword [esp + 0x18]
call fcn.004382cd
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x42b1f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x464628]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, ecx
xorps xmm0, xmm0
push edi
lea edi, [eax + 8]
mov dword [esp + 0x10], eax
push 1
lea eax, [esp + 0x28]
movlpd qword [esp + 0x24], xmm0
push eax
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
jne 0x42b25e
call ebx
test eax, eax
je 0x42b25a
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00437430
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x42b282
call ebx
test eax, eax
jne 0x42b241
mov eax, dword [esp + 0x1c]
xor ecx, ecx
add ecx, dword [esp + 0xc]
push 0
adc eax, 0
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0042c420
test eax, eax
sete bl
test bl, bl
je 0x42b2b1
mov eax, dword [esp + 0x10]
mov byte [eax + 0x34], 1
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x18], xmm0
push esi
call fcn.0042bfe0
test al, al
je 0x42b2d7
test bl, bl
je 0x42b2d7
mov cl, 1
jmp 0x42b2d9
xor cl, cl
xor edx, edx
mov eax, 0x80004005
test cl, cl
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
cmovne eax, edx
pop ebx
xor ecx, esp
call fcn.00437430
mov esp, ebp
pop ebp
ret 8