joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c958
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
xor edx, edx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
test eax, eax
je 0x42c983
push eax
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0042ad08
add esp, 0xc
jmp 0x42cae5
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov edi, eax
push esi
push edi
call sub.GDI32.DLL_SelectObject
lea eax, [ebp - 0x64]
push eax
push 0x18
push esi
call sub.GDI32.DLL_GetObjectA
mov ax, 0x18
mov word [ebp - 0x52], ax
movzx edx, ax
imul edx, dword [ebp - 0x60]
add edx, 0x1f
test edx, edx
jns 0x42c9b8
add edx, 0x1f
sar edx, 5
shl edx, 2
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.004e5ac0
imul dword [ebp - 0x58]
pop ecx
mov dword [ebp - 8], eax
mov word [ebp - 0x20], 0x4d42
mov eax, dword [ebp - 8]
add eax, 0x36
mov dword [ebp - 0x1e], eax
xor eax, eax
mov word [ebp - 0x1a], 0
mov word [ebp - 0x18], 0
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x4c], 0x28
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x48], edx
xor edx, edx
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x44], ecx
xor ecx, ecx
mov word [ebp - 0x40], 1
mov word [ebp - 0x3e], 0x18
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
xor eax, eax
mov dword [ebp - 0x30], eax
xor edx, edx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 8]
push eax
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
jne 0x42ca49
mov eax, dword [ebp - 0x10]
jmp 0x42cae5
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
lea edx, [ebp - 0x4c]
push 0
push edx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 0x44]
push eax
push 0
push esi
push edi
call sub.GDI32.DLL_GetDIBits
push 0
push 0x8000080
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0xc]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x42cad0
lea eax, [ebp - 0xc]
push 0
push eax
lea edx, [ebp - 0x20]
push 0xe
push edx
push esi
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebp - 0xc]
push 0
push ecx
lea eax, [ebp - 0x4c]
push 0x28
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x10], 1
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_GlobalFree
push edi
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4324f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_OutputDebugStringA
test ebx, ebx
jne 0x43250e
push esi
call fcn.004e09d0
pop ecx
mov ebx, eax
cmp dword [0x592e54], 0
je 0x43251c
call fcn.00439b58
test ebx, ebx
jbe 0x43252a
push ebx
push esi
call fcn.0043a358
add esp, 8
cmp dword [0x592e54], 0
je 0x432538
call fcn.00439b78
pop esi
pop ebx
pop ebp
ret
Function at 0x432f6c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
xor eax, eax
mov ecx, 0xb
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push esi
lea edi, [ebp - 0x3c]
mov esi, 0x592e90
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x432fbc
push 0
push 5
call fcn.00438704
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x7dc
push 0x15
call fcn.00488efc
add esp, 0x1c
test ax, ax
je 0x432fd3
cmp ax, 0xffff
jne 0x432fbc
jmp 0x432fd3
push 0xc0
mov edx, dword [ebp + 8]
push edx
call fcn.00448894
add esp, 8
mov dword [ebp - 8], eax
inc eax
je 0x432f90
cmp dword [ebp - 8], 0xffffffff
je 0x433132
jmp 0x433008
push 0
push 5
call fcn.00438704
push eax
push esi
push 0
push 0x7dc
push 0x14
call fcn.00488efc
add esp, 0x1c
test ax, ax
je 0x433018
cmp ax, 0xffff
jne 0x433008
jmp 0x433018
push 0
push esi
call fcn.00436fa8
add esp, 8
mov edi, eax
inc eax
je 0x432fdf
cmp edi, 0xffffffff
je 0x433128
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.DLL_GetFileInformationByHandle
mov dword [ebp - 0xc], eax
push 0x10000
call fcn.004847cc
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
cmp dword [ebp + 0x10], 0
je 0x4330c1
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 0x3c]
push edx
call fcn.004893f0
add esp, 8
jmp 0x4330c1
push 0
push 5
call fcn.00438704
push eax
push esi
push 0
push 0x7e0
push 0x18
call fcn.00488efc
add esp, 0x1c
test ax, ax
je 0x433087
cmp ax, 0xffff
jne 0x43308e
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x4330a0
push ebx
mov eax, dword [ebp - 0x10]
push eax
push edi
call fcn.00437548
add esp, 0xc
cmp ebx, eax
jne 0x433060
cmp dword [ebp + 0x10], 0
je 0x4330c1
push ebx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x3c]
mov ecx, 0xa
push dword [eax + ecx*4]
dec ecx
jns 0x4330b3
call fcn.0043313c
add esp, 0x34
push 0xffff
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
push ecx
call fcn.004374fc
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x43308e
mov edx, dword [ebp - 0x10]
push edx
call fcn.00484894
cmp dword [ebp + 0x10], 0
pop ecx
je 0x4330f6
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00489524
pop ecx
cmp dword [ebp - 0xc], 0
je 0x43310e
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebp - 0x6c]
push ecx
push edi
call sub.KERNEL32.DLL_SetFileTime
push edi
call fcn.004370c4
cmp dword [ebp - 0xc], 0
pop ecx
je 0x433128
mov eax, dword [ebp - 0x70]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
mov ecx, dword [ebp - 8]
push ecx
call fcn.004370c4
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435bc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
xor edx, edx
lea ecx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push ecx
push edi
call fcn.004383cc
add esp, 8
mov edi, eax
push edi
call fcn.004e09d0
pop ecx
mov ebx, eax
lea esi, [edi + ebx - 1]
jmp 0x435bfa
dec ebx
dec esi
test ebx, ebx
je 0x435c13
movsx eax, byte [esi]
push eax
push 0x592fc0
call fcn.004e097c
add esp, 8
test eax, eax
jne 0x435bf8
test ebx, ebx
je 0x435c36
cmp ebx, 0x107
ja 0x435c36
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x435c2e
xor edx, edx
jmp 0x435c33
mov edx, eax
and edx, 0x10
mov dword [ebp - 4], edx
push 0
call fcn.00438730
cmp dword [ebp - 8], 0
pop ecx
je 0x435c4e
mov eax, dword [ebp - 8]
push eax
call fcn.00484894
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x436ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
je 0x436eee
xor eax, eax
jmp 0x436ef3
mov eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.00438748
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x437430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.00452360
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
test ebx, ebx
je 0x437470
mov ax, word [ebp - 4]
jmp 0x437472
xor eax, eax
mov ebx, eax
cmp bx, 0xffff
jne 0x43747d
xor ebx, ebx
call fcn.0045235c
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x437488
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.00452360
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x4374c2
movzx ecx, si
lea edx, [ebp - 4]
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, eax
jmp 0x4374d6
xor edx, edx
mov dword [ebp - 4], edx
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
test ebx, ebx
je 0x4374eb
mov cx, word [ebp - 4]
jmp 0x4374ed
xor ecx, ecx
mov ebx, ecx
call fcn.0045235c
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4374fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.00452360
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x43752d
mov ebx, dword [ebp - 4]
jmp 0x43752f
xor ebx, ebx
push 0
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x437548
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00452360
test esi, esi
je 0x437587
push 0
push 0
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.00438748
add esp, 8
jmp 0x43759f
push 0
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4375ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004bff1c
test eax, eax
je 0x437624
call fcn.00452360
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e0898
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0xc], eax
sar edx, 0x1f
lea edx, [ebp - 0x18]
push edx
push ecx
push edi
push esi
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x437610
mov ebx, dword [ebp - 4]
jmp 0x437612
xor ebx, ebx
push 0
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
jmp 0x43765a
call fcn.00452360
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00437adc
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x437653
cmp eax, dword [ebp + 0x14]
jne 0x437653
push edi
push esi
push ebx
call fcn.004374fc
add esp, 0xc
mov ebx, eax
jmp 0x437655
xor ebx, ebx
call fcn.0045235c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437664
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004bff1c
test eax, eax
je 0x4376d1
call fcn.00452360
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004e0898
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0xc], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x18]
push edx
push ecx
push edi
push esi
push ebx
call fcn.00436908
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
jmp 0x43770b
call fcn.00452360
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00437adc
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x437701
cmp eax, dword [ebp + 0x14]
jne 0x437701
push edi
push esi
push ebx
call fcn.00437548
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x437706
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0045235c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437c00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
call fcn.00452360
push ebx
call sub.KERNEL32.DLL_DeleteFileA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
call fcn.0045235c
cmp dword [ebp - 4], 0
je 0x437c44
mov edx, dword [ebp - 4]
push edx
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x437c4c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.004383cc
add esp, 8
mov esi, eax
call fcn.00452360
push esi
push ebx
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
call fcn.0045235c
cmp dword [ebp - 4], 0
je 0x437ca6
mov ecx, dword [ebp - 4]
push ecx
call fcn.00484894
pop ecx
cmp dword [ebp - 8], 0
je 0x437cb6
mov eax, dword [ebp - 8]
push eax
call fcn.00484894
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x437cc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
call fcn.00452360
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
call fcn.0045235c
cmp dword [ebp - 4], 0
je 0x437d06
mov edx, dword [ebp - 4]
push edx
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x437d0c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
call fcn.00452360
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
call fcn.0045235c
cmp dword [ebp - 4], 0
je 0x437d50
mov edx, dword [ebp - 4]
push edx
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x437d58
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
call fcn.00452360
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
call fcn.0045235c
cmp dword [ebp - 4], 0
je 0x437d9c
mov edx, dword [ebp - 4]
push edx
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x437dc8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov word [ebp - 2], di
mov byte [ebx], 0
test di, di
je 0x437e05
call fcn.00437f48
and eax, 0xff
inc eax
mov word [ebp - 2], ax
cmp di, word [ebp - 2]
je 0x437e05
mov edx, edi
add dl, 0xff
push edx
call fcn.00437ec4
pop ecx
call fcn.00452360
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
call fcn.00438704
mov word [ebp - 4], ax
cmp di, word [ebp - 2]
je 0x437e48
mov cl, byte [ebp - 2]
add cl, 0xff
push ecx
call fcn.00437ec4
mov ax, word [ebp - 4]
pop ecx
push eax
call fcn.00438730
pop ecx
mov byte [ebx + esi - 1], 0
cmp word [ebp - 4], 0
jne 0x437eba
cmp byte [ebx], 0
je 0x437eba
mov edi, ebx
push ebx
call fcn.004e09d0
pop ecx
mov esi, eax
cmp byte [edi + 1], 0x3a
jne 0x437e70
add edi, 2
sub esi, 2
movsx eax, byte [edi]
push eax
push 0x593022
call fcn.004e097c
add esp, 8
test eax, eax
je 0x437e87
inc edi
dec esi
test esi, esi
je 0x437ea3
movsx edx, byte [edi + esi - 1]
push edx
push 0x593022
call fcn.004e097c
add esp, 8
test eax, eax
je 0x437ea3
dec esi
test esi, esi
je 0x437eb6
cmp edi, ebx
je 0x437eb6
push esi
push edi
push ebx
call fcn.004e084c
add esp, 0xc
mov byte [ebx + esi], 0
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x437f7c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov al, byte [ebp + 8]
add al, 0x41
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
call fcn.00452360
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_GetDriveTypeA
mov ebx, eax
call fcn.0045235c
test ebx, ebx
je 0x437fb3
cmp ebx, 1
jne 0x437fb9
mov ax, 0xffff
jmp 0x437fbb
xor eax, eax
mov ebx, eax
push 0
call fcn.00438730
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x438334
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00438748
add esp, 8
call fcn.0045235c
call fcn.00438704
test ax, ax
je 0x438374
call fcn.00438704
jmp 0x4383c6
mov eax, ebx
cmp byte [eax + 1], 0x3a
jne 0x43837f
add eax, 2
cmp eax, ebx
je 0x43838e
push esi
push eax
push ebx
call fcn.004e084c
add esp, 0xc
push ebx
call fcn.004e09d0
pop ecx
mov esi, eax
movsx eax, byte [ebx + esi - 1]
push eax
push 0x593022
call fcn.004e097c
add esp, 8
test eax, eax
je 0x4383b4
mov byte [ebx + esi], 0
jmp 0x4383c4
push 0
push 0x593026
push ebx
call fcn.004bcab4
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x4392f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0x63
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x439328
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x439328
push 0x107
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.004bd890
add esp, 0xc
jmp 0x43933e
push ebx
push 0x107
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x43933e
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
cmp byte [ebx], 0
je 0x43935a
push ebx
call fcn.004e09d0
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x43935a
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
cmp dword [ebp + 0xc], 0
je 0x439372
push 0x107
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.004bd8bc
add esp, 0xc
push ebx
call fcn.004e09d0
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x101
jle 0x43938d
or eax, 0xffffffff
jmp 0x439436
call fcn.004419b8
fstp qword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
lea edi, [ebx + ecx]
fld qword [ebp - 0x14]
fmul dword [0x439440]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.004e5974
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004e5db4
fstp qword [ebp - 0x14]
add esp, 0xc
cmp esi, 9
mov ecx, esi
jle 0x4393d6
mov al, 0x57
jmp 0x4393d8
mov al, 0x30
add cl, al
mov byte [edi], cl
inc dword [ebp - 8]
inc edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 6
jl 0x4393a0
mov edx, dword [ebp - 8]
mov byte [ebx + edx], 0
cmp dword [ebp + 0x18], 0
je 0x439408
push 0x107
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
call fcn.004bd8bc
add esp, 0xc
push 0
push ebx
call fcn.004383cc
add esp, 8
push 0x410
mov eax, dword [ebp + 0x10]
push eax
push ebx
call fcn.00437034
add esp, 0xc
cmp eax, 0xffffffff
jne 0x439436
dec dword [ebp - 4]
jne 0x439303
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439444
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x439474
cmp byte [eax], 0
je 0x439474
push 0x107
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004bd890
add esp, 0xc
jmp 0x439499
lea edx, [ebp - 0x108]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x439499
push 0
push 0
call fcn.00438748
add esp, 8
xor eax, eax
jmp 0x4394c8
mov byte [ebp - 1], 0
mov edx, dword [ebp + 8]
push edx
push 0
test ebx, ebx
jne 0x4394ac
mov ebx, 0x59302c
push ebx
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov ebx, eax
push 0
push ebx
call fcn.00438748
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
mov ebx, dword [ebp + 8]
mov si, 0xffff
mov byte [ebx], 0
lea eax, [ebp - 0x108]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x439665
mov byte [ebp - 1], 0
lea eax, [ebp - 0x108]
push 0x107
push eax
push ebx
xor esi, esi
call fcn.004bd890
add esp, 0xc
test si, si
jne 0x43968f
cmp byte [ebx], 0
je 0x43968f
push ebx
call fcn.004e09d0
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x43969a
cmp eax, 0x107
jge 0x43969a
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x43969a
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bae0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x593440]
mov dword [ebp - 8], eax
mov eax, dword [0x593444]
mov dword [ebp - 4], eax
push 7
call fcn.004847cc
pop ecx
mov ebx, eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.004bcaf8
add esp, 0xc
push 0
push 0x59344c
push ebx
call fcn.004bcab4
add esp, 0xc
lea edx, [ebp - 0x148]
push edx
push ebx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43bb83
test byte [ebp - 0x148], 0x10
je 0x43bb6c
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_CompareFileTime
dec eax
jne 0x43bb6c
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x148]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x43bb3e
push esi
call sub.KERNEL32.DLL_FindClose
push ebx
call fcn.00484894
pop ecx
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov eax, edi
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret