joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430a20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x430a9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_GetFileTime
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x430a89
cmp byte [ebx + 0x40], 0
je 0x430a89
cmp word [ebx + 0x3a], 0
je 0x430a89
push 0
push esi
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.KERNEL32.DLL_ResumeThread
test eax, eax
jne 0x430a89
lea edx, [ebp - 4]
mov eax, dword [0x491834]
call fcn.00407524
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4172c4]
call fcn.0040da6c
call fcn.00404ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430aa6
lea eax, [ebp - 4]
call fcn.00405530
ret

Function at 0x43133c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x43140e
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call fcn.00407b54
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4313e0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call fcn.00407b74
xor edx, edx
push ebp
push 0x4313cf
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004030fc
mov eax, dword [ebp - 4]
call fcn.00431278
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4313d6
mov eax, dword [ebp - 8]
push eax
call fcn.00407b84
ret

Function at 0x431420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 1
call sub.KERNEL32.DLL_TlsGetValue
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x431492
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x431466
mov eax, dword [ebp - 8]
push eax
call fcn.00407b74
mov edx, eax
mov eax, ebx
call fcn.00405728
jmp 0x43146d
mov eax, ebx
call fcn.00405530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431499
cmp dword [ebp - 8], 0
je 0x431489
mov eax, dword [ebp - 8]
push eax
call fcn.00407b84
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4314cc
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x431574
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call fcn.00408064
mov ebx, eax
test bx, bx
je 0x431547
mov edx, ebx
mov eax, dword [0x423298]
call fcn.004273ac
test al, al
je 0x431537
movzx eax, bx
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push 9
call sub.KERNEL32.DLL_TlsGetValue
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.004272bc
call fcn.00404f70
jmp 0x43157b
movzx eax, bx
push eax
call fcn.00408064
mov ebx, eax
test bx, bx
jne 0x4314ff
mov ecx, dword [0x491380]
mov dl, 1
mov eax, dword [0x408b04]
call fcn.0040db28
call fcn.00404ec4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43157b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x431584
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4315dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
push 9
call sub.KERNEL32.DLL_TlsGetValue
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4315e3
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4316b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x43172d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00431278
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.00427380
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.KERNEL32.DLL_LoadResource
cmp dword [ebp - 0x10], 0
je 0x431717
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431734
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x43173c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4317b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00431278
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x60]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.KERNEL32.DLL_LoadResource
cmp dword [ebp - 0x10], 0
je 0x43179b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4317b8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x43180c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x431850
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431857
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x4347c0
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
test byte [ebp + 0x1c], 8
jne 0x434889
test byte [ebp + 0x1c], 2
je 0x4347df
mov byte [ebp + 0x74], 1
jmp 0x434889
mov eax, dword [ebp + 0x6c]
test eax, eax
je 0x4347f0
call fcn.004347c0
jmp 0x434889
mov eax, ebp
call fcn.004348f0
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
mov esi, eax
test esi, esi
sete bl
test esi, esi
jle 0x43483c
push 0x400
mov edi, esi
dec edi
push edi
mov eax, ebp
call fcn.004348f0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
test al, 4
jne 0x434837
push 0x400
push edi
mov eax, ebp
call fcn.004348f0
push eax
call sub.KERNEL32.DLL_GlobalLock
mov bl, 1
dec esi
test esi, esi
jg 0x434808
test bl, bl
je 0x434889
cmp dword [ebp + 0x64], 0
jne 0x434879
mov eax, dword [ebp + 0x70]
mov edx, dword [0x433268]
call fcn.004047dc
test al, al
je 0x434879
mov eax, ebp
call fcn.004348f0
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x434879
mov eax, dword [ebp + 0x34]
push eax
call fcn.00407fe4
xor eax, eax
mov dword [ebp + 0x34], eax
jmp 0x434880
mov eax, ebp
call fcn.00434680
xor edx, edx
mov eax, ebp
mov ecx, dword [eax]
call dword [ecx + 0x3c]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x437fa4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x200]
mov eax, dword [ebp + 8]
add eax, 0xfffffffb
mov dword [ebp - 8], eax
xor esi, esi
jmp 0x43803d
push ebx
mov eax, dword [ebp - 8]
sub eax, ebx
push eax
push 0x400
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x204]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.004385ac
mov eax, ebx
call fcn.0040a808
mov ebx, eax
push 0x400
push esi
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov edi, eax
test di, 2
je 0x438019
mov byte [ebx], 0x24
inc ebx
mov byte [ebx], 0
test di, 0x40
je 0x438027
mov byte [ebx], pe_nt_image_headers32
inc ebx
mov byte [ebx], 0
test di, 1
je 0x438035
mov byte [ebx], 0x23
inc ebx
mov byte [ebx], 0
mov byte [ebx], 0x3b
inc ebx
mov byte [ebx], 0
inc esi
cmp esi, dword [ebp - 0xc]
jge 0x438047
cmp ebx, dword [ebp - 8]
jb 0x437fd2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438430
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4384e4
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
push 0x400
push esi
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov edi, eax
push ebp
movzx eax, byte [ebx + 4]
push eax
mov eax, dword [ebx + 8]
mov ecx, esi
mov edx, edi
call fcn.00438294
pop ecx
test al, al
je 0x4384de
test di, 2
je 0x4384b0
cmp dword [ebp - 0xc], 0
jge 0x4384de
mov dword [ebp - 0xc], 0xfffffffe
jmp 0x4384de
cmp dword [ebp - 0xc], 0
jge 0x4384c2
mov dword [ebp - 0xc], esi
mov dword [ebx + 0xc], 2
jmp 0x4384c9
mov dword [ebx + 0xc], 3
test di, 0x80
je 0x4384d5
mov dword [ebp - 0x10], esi
jmp 0x4384de
cmp dword [ebp - 0x10], 0
jl 0x4384de
mov dword [ebp - 0x14], esi
inc esi
dec dword [ebp - 0x18]
jne 0x438472
cmp dword [ebp - 0xc], 0xffffffff
jge 0x4384f6
mov dword [ebx + 0xc], 0x10000
jmp 0x4385a3
cmp dword [ebp - 0xc], 0
jge 0x438576
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x438576
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
push 0x400
push esi
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov edi, eax
push ebp
movzx eax, byte [ebx + 4]
push eax
mov eax, dword [ebx + 8]
mov ecx, esi
mov edx, edi
call fcn.004382f0
pop ecx
test al, al
je 0x438570
test di, 2
je 0x438542
mov dword [ebx + 0xc], 0x10000
jmp 0x4385a3
cmp dword [ebp - 0xc], 0
jge 0x438554
mov dword [ebp - 0xc], esi
mov dword [ebx + 0xc], 2
jmp 0x43855b
mov dword [ebx + 0xc], 3
test di, 0x80
je 0x438567
mov dword [ebp - 0x10], esi
jmp 0x438570
cmp dword [ebp - 0x10], 0
jl 0x438570
mov dword [ebp - 0x14], esi
inc esi
dec dword [ebp - 0x18]
jne 0x43850a
mov eax, dword [ebx + 0xc]
cmp eax, 2
jne 0x438589
shl eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
jmp 0x4385a3
cmp eax, 3
jne 0x4385a3
cmp dword [ebp - 0x14], 0
jge 0x43859a
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
shl eax, 0x10
or eax, dword [ebp - 0x14]
mov dword [ebx + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b628
Capabilities:
Clear file content
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test esi, esi
je 0x43b66f
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_FindFirstFileA
test bl, bl
je 0x43b64a
test ah, 2
jne 0x43b66f
or eax, 0x200
jmp 0x43b654
test ah, 2
je 0x43b66f
and eax, 0xfffffdff
push eax
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
push 0x37
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
pop esi
pop ebx
ret
Function at 0x43b674
Capabilities:
Clear file content
Get disk size
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp + 1], cl
mov byte [esp], dl
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov eax, dword [0x496c1c]
cmp esi, dword [eax + 0x30]
jne 0x43b69b
or edi, 0x8000000
push esi
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
test eax, eax
jne 0x43b6ca
mov eax, dword [0x496c1c]
cmp esi, dword [eax + 0x30]
jne 0x43b6c6
mov eax, dword [0x496c1c]
cmp byte [eax + 0x5b], 0
jne 0x43b6ca
xor eax, eax
jmp 0x43b6cc
mov al, 1
mov byte [esp + 2], al
movzx eax, byte [esp + 2]
or al, bl
je 0x43b6e1
push 0
push esi
call sub.KERNEL32.DLL_SetThreadLocale
cmp byte [esp], 0
je 0x43b6f8
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x43b707
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.KERNEL32.DLL_SetEndOfFile
movzx eax, byte [esp + 1]
and al, byte [esp + 2]
jne 0x43b716
test bl, bl
je 0x43b72c
test bl, bl
je 0x43b724
push 6
push esi
call sub.KERNEL32.DLL_SetThreadLocale
jmp 0x43b72c
push 5
push esi
call sub.KERNEL32.DLL_SetThreadLocale
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x43f154
Capabilities:
Clear file content
Set file attributes

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov edi, eax
cmp dl, byte [edi + 0x271]
je 0x43f2eb
mov byte [edi + 0x271], dl
cmp byte [edi + 0x258], 0
je 0x43f185
movzx eax, byte [edi + 0x271]
sub al, 2
je 0x43f189
sub al, 3
je 0x43f189
xor edx, edx
jmp 0x43f18b
mov dl, 1
mov eax, edi
call fcn.0043cadc
mov eax, edi
call fcn.004587a0
test al, al
je 0x43f2eb
test byte [edi + 0x1c], 0x10
je 0x43f1bb
test byte [edi + 0x1c], 0x10
je 0x43f2eb
cmp dword [edi + 0x30], 0
je 0x43f2eb
push 0xfffffffffffffff0
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [esp], eax
push 0xffffffffffffffec
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [esp + 4], eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.00458494
push eax
call fcn.004080cc
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, edi
mov si, 0xffa9
call fcn.0040484c
lea ecx, [esp + 4]
mov edx, esp
mov eax, edi
mov si, 0xffaa
call fcn.0040484c
mov eax, dword [esp]
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffec
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [esp + 8]
push eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov eax, edi
call fcn.004587a0
test al, al
je 0x43f2c8
mov eax, dword [0x4914f8]
cmp byte [eax], 0
je 0x43f2a9
cmp byte [edi + 0x271], 3
je 0x43f293
mov eax, edi
call fcn.00440fe0
push eax
push 1
push 0x80
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_HeapFree
jmp 0x43f2a9
push 0
push 1
push 0x80
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_HeapFree
push 0xffffffffffffffff
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_FileTimeToDosDateTime
push 0
xor ecx, ecx
mov edx, 0x81
mov eax, edi
call fcn.004519e8
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x80]
add esp, 0xc
pop edi
pop esi
ret
Function at 0x43f574
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp bl, byte [eax + 0x277]
je 0x43f6e3
test bl, bl
jne 0x43f59f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 3
je 0x43f5b0
cmp bl, 3
jne 0x43f60e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 0
jne 0x43f60e
mov eax, dword [ebp - 4]
mov byte [eax + 0x277], bl
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x43f6e3
mov eax, dword [ebp - 4]
call fcn.004587a0
test al, al
je 0x43f6e3
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x277], 3
sete al
and eax, 0x7f
mov eax, dword [eax*4 + 0x48f56c]
push eax
mov eax, dword [ebp - 4]
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
jmp 0x43f6e3
cmp bl, 1
jne 0x43f629
mov eax, dword [ebp - 4]
cmp byte [eax + 0x278], 0
jne 0x43f629
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0043fa7c
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
setne al
xor al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43f648
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00459834
xor edx, edx
push ebp
push 0x43f6dc
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 5], 0
je 0x43f667
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xb0]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x277]
mov edx, dword [ebp - 4]
mov byte [edx + 0x277], bl
cmp bl, 2
je 0x43f683
cmp al, 2
jne 0x43f6a1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d9], 0
jne 0x43f6a1
mov eax, dword [ebp - 4]
call fcn.0043fbb4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004508a4
cmp byte [ebp - 5], 0
je 0x43f6af
mov eax, dword [ebp - 4]
call fcn.00455054
cmp bl, 1
jne 0x43f6be
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0043e2a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f6e3
cmp byte [ebp - 5], 0
je 0x43f6db
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00459834
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43f6e8
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, eax
cmp byte [ebp + 0x277], 2
jne 0x43f75c
cmp dword [ebp + 0x29c], 0
je 0x43f75c
xor esi, esi
mov eax, dword [ebp + 0x290]
test eax, eax
je 0x43f713
mov edx, dword [eax]
call dword [edx + 0x34]
mov esi, eax
xor edi, edi
mov eax, dword [ebp + 0x2a0]
test eax, eax
je 0x43f726
call fcn.004348f0
mov edi, eax
mov eax, ebp
call fcn.00458494
push eax
call sub.KERNEL32.DLL_CopyFileA
cmp esi, eax
setne bl
push edi
push esi
push 0x230
mov eax, dword [ebp + 0x29c]
push eax
call sub.KERNEL32.DLL_HeapFree
test bl, bl
je 0x43f75c
mov eax, ebp
call fcn.00458494
push eax
call fcn.00408024
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43f7b0
Capabilities:
Copy file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f9c4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x43f844
mov eax, dword [0x496c20]
call fcn.00443ca0
dec eax
test eax, eax
jl 0x43f844
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov edx, edi
mov eax, dword [0x496c20]
call fcn.00443c8c
cmp esi, dword [eax + 0x290]
jne 0x43f83e
mov edx, edi
mov eax, dword [0x496c20]
call fcn.00443c8c
cmp ebx, eax
je 0x43f83e
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x4913c8]
call fcn.00407524
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x417320]
call fcn.0040daa8
call fcn.00404ec4
inc edi
dec dword [ebp - 4]
jne 0x43f7e9
mov eax, dword [ebx + 0x290]
test eax, eax
je 0x43f855
xor edx, edx
call fcn.00438164
test byte [ebx + 0x1c], 8
jne 0x43f865
test esi, esi
je 0x43f867
test byte [esi + 0x1c], 8
je 0x43f867
xor esi, esi
mov dword [ebx + 0x290], esi
test esi, esi
je 0x43f87a
mov edx, ebx
mov eax, esi
call fcn.0041ff44
test esi, esi
je 0x43f92d
test byte [ebx + 0x1c], 0x10
jne 0x43f895
cmp byte [ebx + 0x271], 3
je 0x43f92d
mov eax, dword [ebx + 0x290]
cmp byte [eax + 0x5c], 0
jne 0x43f8aa
cmp byte [ebx + 0x277], 1
jne 0x43f8b0
test byte [ebx + 0x1c], 0x10
je 0x43f908
mov eax, ebx
call fcn.004587a0
test al, al
je 0x43f947
mov eax, dword [ebx + 0x290]
mov edx, dword [eax]
call dword [edx + 0x34]
mov edi, eax
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_CopyFileA
cmp edi, eax
je 0x43f8f6
mov eax, dword [ebx + 0x290]
mov edx, dword [eax]
call dword [edx + 0x34]
push eax
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_MoveFileA
mov eax, ebx
call fcn.00458494
mov edx, eax
mov eax, esi
call fcn.00438164
jmp 0x43f947
cmp byte [ebx + 0x277], 1
je 0x43f947
mov eax, ebx
call fcn.004587a0
test al, al
je 0x43f947
push 0
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_MoveFileA
jmp 0x43f947
mov eax, ebx
call fcn.004587a0
test al, al
je 0x43f947
push 0
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp byte [ebx + 0x276], 0
je 0x43f959
mov dl, 1
mov eax, ebx
call fcn.00440e6c
mov eax, ebx
call fcn.0043f6e8
cmp dword [ebx + 0x298], 0
je 0x43f9ae
test byte [ebx + 0x1c], 0x10
je 0x43f9ae
cmp dword [ebx + 0x30], 0
je 0x43f9ae
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
xor ecx, ecx
mov edx, 0x85
mov eax, ebx
call fcn.004519e8
push 0
xor ecx, ecx
mov edx, 0xf
mov eax, ebx
call fcn.004519e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f9cb
lea eax, [ebp - 0x10]
call fcn.00405530
ret
Function at 0x4432cc
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebx
push esi
mov ebx, eax
test byte [ebx + 0x1c], 0x10
jne 0x44339f
cmp dword [0x48f504], 0
je 0x44339f
mov eax, ebx
call fcn.004587a0
test al, al
je 0x44339f
push 0xffffffffffffffec
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp byte [ebx + 0x328], 0
jne 0x443319
cmp byte [ebx + 0x350], 0
je 0x443373
test esi, 0x80000
jne 0x443337
or esi, 0x80000
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetEndOfFile
movzx eax, byte [ebx + 0x328]
mov eax, dword [eax*4 + 0x48f598]
movzx edx, byte [ebx + 0x350]
or eax, dword [edx*4 + 0x48f5a0]
push eax
movzx eax, byte [ebx + 0x329]
push eax
mov eax, dword [ebx + 0x354]
push eax
mov eax, ebx
call fcn.00458494
push eax
call dword [0x48f504]
jmp 0x44339f
and esi, 0xfff7ffff
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0x485
push 0
push 0
mov eax, ebx
call fcn.00458494
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
pop esi
pop ebx
ret