joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4277b0
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x446683
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x288], eax
push esi
push edi
mov eax, dword [0x4551b0]
xor eax, esp
push eax
lea eax, [esp + 0x298]
mov dword fs:[0], eax
xor edi, edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x2a0], edi
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], edi
call fcn.00412020
lea edx, [esp + 0x68]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2a0], 1
call fcn.00412860
push 0x208
lea ecx, [esp + 0x8a]
push edi
mov byte [esp + 0x2a8], 2
push ecx
mov word [esp + 0x90], di
call fcn.00433170
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [esp + 0x84]
mov word [esp + 0x28a], di
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], edi
mov word [esp + 0x50], di
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x427880
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x88]
push ecx
lea esi, [esp + 0x54]
call fcn.00401a90
mov byte [esp + 0x2a0], 3
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], edi
mov word [ebx + 4], di
mov ecx, dword [esp + 0x50]
mov esi, 8
cmp dword [esp + 0x64], esi
mov dword [esp + 0x10], 1
jae 0x4278d2
lea ecx, [esp + 0x50]
cmp dword [esp + 0x80], esi
mov eax, dword [esp + 0x6c]
jae 0x4278e3
lea eax, [esp + 0x6c]
push ecx
push eax
push str.mac_scom_s
mov ecx, ebx
call fcn.0042de04
add esp, 0xc
cmp dword [esp + 0x64], esi
jb 0x427907
mov edx, dword [esp + 0x50]
push edx
call fcn.00431474
add esp, 4
cmp dword [esp + 0x80], esi
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], edi
mov word [esp + 0x50], di
jb 0x42792e
mov eax, dword [esp + 0x6c]
push eax
call fcn.00431474
add esp, 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], edi
mov word [esp + 0x6c], di
call fcn.004120a0
mov eax, ebx
mov ecx, dword [esp + 0x298]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.00431b07
add esp, 0x298
ret
Function at 0x427980
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4481eb
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551b0]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
push 0x20
xor ebx, ebx
mov ebp, 7
push str.4705374c8015e8a66c6d1920f65bc499
lea esi, [esp + 0x74]
mov edi, ecx
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
call fcn.00401a90
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov ebp, 8
mov byte [esp + 0xb0], 1
cmp dword [edi + 0x18], ebp
jb 0x427a12
mov edi, dword [edi + 4]
jmp 0x427a15
add edi, 4
cmp dword [esp + 0x84], ebp
mov eax, dword [esp + 0x70]
jae 0x427a26
lea eax, [esp + 0x70]
push edi
push eax
push 0x44d4dc
lea ecx, [esp + 0x24]
call fcn.0042de04
add esp, 0xc
lea eax, [esp + 0x34]
push ebx
push eax
lea esi, [esp + 0x20]
call fcn.0042e96b
add esp, 8
mov byte [esp + 0xb0], 2
mov ecx, dword [esp + 0x38]
mov edi, 0x10
cmp dword [esp + 0x4c], edi
jae 0x427a66
lea ecx, [esp + 0x38]
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x90]
call fcn.0042fa53
add esp, 8
lea esi, [esp + 0x50]
mov byte [esp + 0xb0], 3
call fcn.0042dced
cmp dword [esp + 0x64], 0xa
jb 0x427adf
mov ecx, esi
push 0xa
push ecx
xor ecx, ecx
lea esi, [esp + 0x90]
call fcn.0040cda0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], 4
call fcn.004019a0
mov byte [esp + 0xb0], 3
cmp dword [esp + 0xa0], ebp
jb 0x427adf
mov edx, dword [esp + 0x8c]
push edx
call fcn.00431474
add esp, 4
cmp dword [esp + 0x30], ebp
mov eax, dword [esp + 0x1c]
jae 0x427aed
lea eax, [esp + 0x1c]
push eax
push str.http:__huodong.2345.com_desktop_index.php_d_s
lea ecx, [esp + 0x20]
call fcn.0042de04
lea eax, [esp + 0x20]
mov byte [esp + 0x1f], bl
push eax
lea ebx, [esp + 0x23]
call fcn.00421200
add esp, 0xc
cmp dword [esp + 0x68], ebp
jb 0x427b24
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00431474
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x4c], edi
mov esi, 7
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
jb 0x427b4b
mov edx, dword [esp + 0x38]
push edx
call fcn.00431474
add esp, 4
cmp dword [esp + 0x30], ebp
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
jb 0x427b6e
mov eax, dword [esp + 0x1c]
push eax
call fcn.00431474
add esp, 4
cmp dword [esp + 0x84], ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
jb 0x427b91
mov ecx, dword [esp + 0x70]
push ecx
call fcn.00431474
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00431b07
add esp, 0xa0
ret
Function at 0x4282a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x448468
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
mov eax, dword [0x4551b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea eax, [esp + 0x13]
push eax
lea edx, [esp + 0x50]
xor ebx, ebx
push edx
mov byte [esp + 0x1b], bl
call fcn.00424790
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x80], ebx
call fcn.00424bb0
add esp, 8
mov byte [esp + 0x78], 1
push 0xc
push str.2345Explorer
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.00401a90
lea edx, [esp + 0x30]
push edx
mov ecx, esi
mov byte [esp + 0x7c], 2
call fcn.004262c0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x428353
mov eax, dword [esp + 0x18]
push eax
call fcn.00431474
add esp, 4
cmp dword [esp + 0x48], esi
jb 0x428366
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00431474
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
jb 0x42838a
mov edx, dword [esp + 0x50]
push edx
call fcn.00431474
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.00431b07
mov esp, ebp
pop ebp
ret

Function at 0x428ff0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x23c
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x240]
push esi
push 0
push 2
mov dword [esp + 0x14], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x42903e
xor al, al
pop esi
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00431b07
add esp, 0x23c
ret 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0x22c
call fcn.00433170
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4290dc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x429090
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x40]
call fcn.0042da81
test al, al
je 0x4290c6
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x10], eax
je 0x4290c6
push eax
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x4290c6
push 0x1770
push esi
call ebx
push esi
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x429090
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x23c]
pop esi
xor ecx, esp
mov al, 1
call fcn.00431b07
add esp, 0x23c
ret 4
Function at 0x42b510
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44625b
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.0043fd40
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x1024], eax
push ebx
push ebp
push esi
mov eax, dword [0x4551b0]
xor eax, esp
push eax
lea eax, [esp + 0x1038]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1048]
mov ebp, dword [esp + 0x104c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], bx
lea esi, [eax + 0x94]
push esi
mov dword [esp + 0x1044], ebx
call fcn.0042f0e7
add esp, 4
test al, al
jne 0x42b5ad
push ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0x44b33c
mov esi, edi
mov word [edi + 4], bx
call fcn.00401a90
jmp 0x42b651
push 0x1000
lea ecx, [esp + 0x36]
push ebx
push ecx
mov word [esp + 0x3c], bx
call fcn.00433170
mov eax, 8
add esp, 0xc
cmp dword [esi + 0x18], eax
jb 0x42b5d4
mov esi, dword [esi + 4]
jmp 0x42b5d7
add esi, 4
cmp dword [ebp + 0x18], eax
jb 0x42b5e1
mov ebp, dword [ebp + 4]
jmp 0x42b5e4
add ebp, 4
push esi
push 0x800
lea edx, [esp + 0x38]
push edx
push 0x44b33c
push ebp
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [eax - 1]
cmp ecx, 0x7fe
ja 0x42b635
mov word [esp + eax*2 + 0x30], bx
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42b617
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x34]
push edx
lea esi, [esp + 0x1c]
call fcn.00401a90
push 0xffffffffffffffff
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push ebx
lea eax, [esp + 0x1c]
mov ecx, edi
mov word [edi + 4], bx
call fcn.004019a0
cmp dword [esp + 0x2c], 8
jb 0x42b665
mov eax, dword [esp + 0x18]
push eax
call fcn.00431474
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x1038]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.00431b07
add esp, 0x1034
ret 8
Function at 0x42c870
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x447dfd
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4551b0]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4551b0]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x27c]
push ebp
mov dword [esp + 0x20], ebp
call fcn.00410110
xor esi, esi
lea edi, [ebp + 0x1c]
mov dword [esp + 0x274], esi
mov eax, 7
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], esi
mov word [edi + 4], si
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x4c], esi
mov word [ebp + 0x3c], si
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x74], esi
mov word [ebp + 0x64], si
mov dword [ebp + 0x94], eax
mov dword [ebp + 0x90], esi
mov word [ebp + 0x80], si
mov dword [ebp + 0xb0], eax
mov dword [ebp + 0xac], esi
mov word [ebp + 0x9c], si
mov dword [ebp + 0xcc], eax
mov dword [ebp + 0xc8], esi
mov word [ebp + 0xb8], si
lea ebx, [ebp + 0xd0]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], esi
mov word [ebx + 4], si
mov dword [ebp + 0x108], eax
mov dword [ebp + 0x104], esi
mov word [ebp + 0xf4], si
push esi
mov byte [esp + 0x278], 8
call fcn.00431db5
add esp, 4
push eax
call fcn.00431d86
add esp, 4
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], esi
call fcn.00407320
call fcn.0042faa7
cmp dword [ebp + 0xe4], esi
je 0x42ca73
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], esi
mov word [esp + 0x40], si
push 0x208
lea eax, [esp + 0x5e]
push esi
mov byte [esp + 0x27c], 9
push eax
mov word [esp + 0x64], si
call fcn.00433170
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [esp + 0x58]
mov word [esp + 0x25e], si
lea edx, [eax + 2]
jmp 0x42c9e0
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x42c9e0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
push eax
lea esi, [esp + 0x44]
call fcn.00401a90
mov ecx, esi
push 0x44bb20
push ecx
call fcn.0042dc93
add esp, 8
push 9
push str..CEIZ.log
mov ecx, esi
call fcn.0040a5f0
mov edx, esi
push edx
push ebx
lea ecx, [esp + 0x28]
call fcn.0042ecdc
add esp, 8
push 0xffffffffffffffff
xor edi, edi
push edi
mov ecx, ebx
mov byte [esp + 0x27c], 0xa
call fcn.004019a0
mov esi, 8
cmp dword [esp + 0x38], esi
jb 0x42ca58
mov eax, dword [esp + 0x24]
push eax
call fcn.00431474
add esp, 4
cmp dword [esp + 0x54], esi
jb 0x42ca6b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00431474
add esp, 4
mov dword [ebp + 0xec], edi
jmp 0x42ca79
mov dword [ebp + 0xec], esi
mov eax, ebp
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x254]
xor ecx, esp
call fcn.00431b07
add esp, 0x264
ret 4
Function at 0x42f0e7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x446018
call fcn.0043432f
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401910
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042ebf9
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x42f11a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f128
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov al, bl
call fcn.00434379
ret

Function at 0x42f138
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x446018
call fcn.0043432f
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401910
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042ebf9
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x42f16b
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f17d
test al, 0x10
jne 0x42f17d
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov al, bl
call fcn.00434379
ret

Function at 0x42f18d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x446018
call fcn.0043432f
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x2c]
call fcn.00401910
xor ebx, ebx
push 0x24
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042ebf9
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
pop ecx
jae 0x42f1c0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f1d2
test al, 0x10
je 0x42f1d2
mov bl, 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov al, bl
call fcn.00434379
ret

Function at 0x42f1e2
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x42f1f0
mov eax, dword [esi]
jmp 0x42f1f2
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f20d
and eax, 0xfffffffe
push 0
push eax
mov eax, edi
call fcn.0042fa7b
pop ecx
pop ecx
cmp dword [edi + 0x18], 8
jb 0x42f215
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop esi
ret

Function at 0x42f729
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax]
test eax, eax
jne 0x42f737
xor al, al
leave
ret
cmp dword [eax], 0xffffffff
je 0x42f733
push edi
lea ecx, [ebp - 4]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42f75e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42f75e
xor al, al
jmp 0x42f779
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0043b080
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret
Function at 0x42f8aa
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, eax
call fcn.0042f94b
cmp dword [edi + 0x14], 0
je 0x42f8cb
cmp dword [edi + 0x18], 8
jb 0x42f8c6
mov edi, dword [edi + 4]
jmp 0x42f8cd
add edi, 4
jmp 0x42f8cd
xor edi, edi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 4], eax
je 0x42f8f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov dword [esi], eax
jmp 0x42f8fd
mov dword [esi], 1
pop edi
mov eax, esi
pop esi
jmp 0x42f906
cmp dword [eax + 4], 0
setne al
ret

Function at 0x42fa8e
Capabilities:
Copy file

Disassembly:
jmp 0x430538
cmp dword [eax + 0x18], 8
jb 0x430543
mov eax, dword [eax + 4]
jmp 0x430546
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x430551
mov ecx, dword [ecx + 4]
jmp 0x430554
add ecx, 4
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
ret

Function at 0x42fa93
Capabilities:
Delete directory

Disassembly:
jmp 0x430564
cmp dword [eax + 0x18], 8
jb 0x43056f
mov eax, dword [eax + 4]
jmp 0x430572
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
ret

Function at 0x42fa98
Capabilities:
Create directory

Disassembly:
jmp 0x43057f
cmp dword [eax + 0x18], 8
jb 0x43058a
mov eax, dword [eax + 4]
jmp 0x43058d
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
ret

Function at 0x42faac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x4c
mov eax, 0x4479f8
call fcn.0043432f
mov edi, ecx
push 2
push 0x44ddcc
mov eax, edi
call fcn.0042d810
cmp eax, 0xffffffff
jne 0x42faee
cmp dword [edi + 0x18], 8
jb 0x42fad8
mov edi, dword [edi + 4]
jmp 0x42fadb
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x42fb10
lea esi, [ebp - 0x58]
call fcn.0042efaf
and dword [ebp - 4], 0
mov eax, esi
push eax
push edi
call fcn.0042f5d6
pop ecx
pop ecx
mov ecx, esi
mov bl, al
call fcn.0042efe2
mov al, bl
call fcn.00434379
ret

Function at 0x4303cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4551b0]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x210], 0
push 0x20a
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.00433170
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x43042c
and word [ebp - 6], 0
push edi
lea edx, [ebp - 0x210]
call fcn.00401970
mov al, 1
jmp 0x43042e
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431b07
leave
ret

Function at 0x43043a
Capabilities:
Set file attributes

Disassembly:
cmp dword [esp + 4], 0xffffffff
jne 0x430444
xor al, al
ret
and dword [esp + 4], 0xffffb1af
cmp dword [eax + 0x18], 8
jb 0x430457
mov eax, dword [eax + 4]
jmp 0x43045a
add eax, 4
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x43046b
Capabilities:
Move file

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x430476
mov eax, dword [eax + 4]
jmp 0x430479
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x430484
mov ecx, dword [ecx + 4]
jmp 0x430487
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret

Function at 0x4305a1
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x4305b5
mov eax, dword [esi]
jmp 0x4305b7
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4305c9
mov al, 1
jmp 0x43065a
cmp dword [edi + 0x18], 8
jb 0x4305d3
mov eax, dword [esi]
jmp 0x4305d5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x430658
cmp dword [edi + 0x18], 8
jb 0x4305ee
mov edx, dword [esi]
jmp 0x4305f0
mov edx, esi
push ebx
lea eax, [ebp - 0x20]
call fcn.00402e70
push 0
lea eax, [ebp - 0x20]
call fcn.0043043a
mov bl, al
neg bl
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x20]
inc bl
call fcn.00401940
test bl, bl
pop ebx
jne 0x430658
cmp dword [edi + 0x18], 8
jb 0x430623
mov eax, dword [esi]
jmp 0x430625
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4305c2
cmp dword [edi + 0x18], 8
jb 0x43063a
mov edx, dword [esi]
jmp 0x43063c
mov edx, esi
lea eax, [ebp - 0x20]
call fcn.00402e70
push dword [ebp - 4]
lea eax, [ebp - 0x20]
call fcn.0043043a
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00401940
xor al, al
pop esi
leave
ret

Function at 0x43065d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4551b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x456538], edi
je 0x430691
push 0xffffffffffffffff
push edi
mov eax, 0x456524
mov ecx, ebx
call fcn.004019a0
mov al, 1
jmp 0x43072e
push 0x20a
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call fcn.00433170
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x43072c
push esi
push 0x410
lea eax, [ebp - 0x622]
push edi
push eax
mov word [ebp - 6], di
mov word [ebp - 0x624], di
call fcn.00433170
add esp, 0xc
mov esi, 0x208
push esi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, esi
pop esi
ja 0x43071b
cmp eax, edi
je 0x43071b
mov word [ebp + eax*2 - 0x624], di
lea edx, [ebp - 0x624]
jmp 0x430721
lea edx, [ebp - 0x210]
push ebx
call fcn.00401970
jmp 0x43068a
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00431b07
leave
ret
Function at 0x43073b
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4551b0]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
and word [ebp - 0x7c], 0
push esi
push edi
push 0x20a
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7a]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.00433170
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x430788
mov esi, dword [esi + 4]
jmp 0x43078b
add esi, 4
cmp dword [edi + 0x18], 8
jb 0x430796
mov edi, dword [edi + 4]
jmp 0x430799
add edi, 4
lea eax, [ebp - 0x7c]
push eax
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
pop edi
pop esi
jbe 0x4307c4
push dword [ebp - 0x80]
and word [ebp + 0x18e], 0
lea edx, [ebp - 0x7c]
call fcn.00401970
mov al, 1
jmp 0x4307c6
xor al, al
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
call fcn.00431b07
add ebp, 0x194
leave
ret

Function at 0x4308b3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x4308be
mov eax, dword [eax + 4]
jmp 0x4308c1
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret