joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
xor ebp, ebp
cmp eax, ebp
je 0x428945
mov ecx, dword [edi + eax*4]
push ebx
mov ebx, dword [0x5050c4]
mov ecx, dword [ebx + ecx*4]
push esi
cmp ecx, 0x7fff
je 0x4288ab
add ecx, ecx
cmp ecx, 0x7fff
jb 0x428898
add ecx, 0xffff8001
mov edx, dword [0x5050c0]
mov ecx, dword [edx + ecx*4]
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ecx
jmp 0x4288b3
mov esi, dword [esp + 0x14]
mov dword [esi + eax*8 - 4], ebp
mov ecx, dword [edi]
sub ecx, 1
je 0x4288f8
lea edx, [esi + ecx*8 - 4]
mov edi, edi
mov dword [edx + 4], ebp
mov eax, dword [edi + ecx*4]
mov eax, dword [ebx + eax*4]
cmp eax, 0x7fff
je 0x4288ee
add eax, eax
cmp eax, 0x7fff
jb 0x4288de
add eax, 0xffff8001
mov ebp, dword [0x5050c0]
mov eax, dword [ebp + eax*4]
mov dword [edx], eax
xor ebp, ebp
jmp 0x4288f0
mov dword [edx], ebp
dec ecx
sub edx, 8
cmp ecx, ebp
jne 0x4288c0
mov eax, dword [edi]
lea ecx, [eax + eax - 1]
cmp ecx, 0x11
mov dword [esi], ecx
jle 0x428923
lea eax, [esi + ecx*4 - 0x38]
lea edx, [ecx - 0x11]
lea esp, [esp]
mov ecx, dword [eax + 0x38]
xor dword [eax - 0xc], ecx
xor dword [eax], ecx
mov dword [eax + 0x38], ebp
sub eax, 4
sub edx, 1
jne 0x428910
cmp dword [esi], 0x11
jbe 0x42893e
mov dword [esi], 0x11
mov edi, edi
mov eax, dword [esi]
cmp dword [esi + eax*4], ebp
jne 0x42893e
dec eax
mov dword [esi], eax
cmp eax, ebp
jne 0x428930
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], ebp
pop ebp
ret 8
Function at 0x42a9f0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0xab8
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0xab4], eax
mov eax, dword [esp + 0xabc]
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4001
mov esi, ecx
push 0x2b4
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x4c879c
mov dword [esi], eax
call edi
test eax, eax
jne 0x42aa60
push 0x400
lea edx, [esp + 0x2c0]
push edx
call fcn.0048bd60
push 0x4001
push 0x2b4
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x2cc]
push ecx
call edi
mov edx, dword [esi]
push eax
push 0
push 0x1109
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0xabc]
pop edi
pop esi
xor ecx, esp
call fcn.004b102c
add esp, 0xab8
ret 4

Function at 0x42aec0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push esi
mov esi, dword [esp + 0x2c4]
push edi
mov edi, dword [esp + 0x2cc]
push 0x4009
push 0x2b4
lea eax, [esp + 0x14]
push eax
push 0
push esi
call ebx
mov ecx, dword [esp + 0x10]
push 0x400b
push 0x2b4
lea edx, [esp + 0x14]
push edx
push 0
push esi
mov dword [edi + 0x18], ecx
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c0]
mov dword [edi + 0x1c], eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b102c
add esp, 0x2b8
ret 8
Function at 0x42c1e0
Capabilities:
Delete file
Log keystrokes via polling
Move file

Disassembly:
mov eax, 0x1050
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x104c], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
mov esi, ecx
mov eax, dword [esi]
push 0x110a
push eax
call edi
test eax, eax
je 0x42c305
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x113e
push edx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
call edi
test eax, eax
je 0x42c305
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x42c305
mov edx, dword [eax + 8]
lea ecx, [esp + 0x854]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42c305
push ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
push 0x400
shr ebx, 0xf
lea eax, [esp + 0x85c]
push eax
lea ecx, [esp + 0x5c]
not bl
push ecx
and bl, 1
call fcn.004709a0
lea eax, [esp + 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42c295
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x56], dx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
movzx eax, bl
neg eax
sbb eax, eax
lea edx, [esp + 0xc]
and eax, 0x40
lea ecx, [esp + 0x54]
push edx
mov dword [esp + 0x14], 3
mov word [esp + 0x20], ax
mov dword [esp + 0x18], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
movzx eax, byte [esi + 8]
push eax
mov ecx, esi
call fcn.0042c100
pop ebx
mov ecx, dword [esp + 0x1054]
pop edi
pop esi
xor ecx, esp
call fcn.004b102c
add esp, 0x1050
ret
Function at 0x42cb30
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [esp + 0x1014]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x42cbf8
push 0x400
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004566d0
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cb80
sub eax, edx
lea ecx, [esp + 8]
sar eax, 1
push ecx
mov esi, eax
call fcn.00457b30
test al, al
jne 0x42cbd3
lea edx, [esp + 0x808]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x808]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42cbc0
sub eax, edx
sar eax, 1
lea esi, [esi + eax + 1]
cmp esi, 0x104
jbe 0x42cbf8
push 0x104
push 0x564
call fcn.004671c0
push eax
push 0x4c8d2c
call fcn.0049ac10
add esp, 0xc
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004b102c
add esp, 0x1004
ret 8
Function at 0x433fe0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4c42db
mov eax, dword fs:[0]
push eax
mov eax, 0x30cc
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x30c8], eax
push ebx
push esi
push edi
mov eax, dword [0x4da8f0]
xor eax, esp
push eax
lea eax, [esp + 0x30dc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30ec]
lea ecx, [esp + 0x184c]
call fcn.004129c0
lea ecx, [esp + 0x1870]
call fcn.004129c0
lea ecx, [esp + 0x1894]
call fcn.004129c0
push 0
lea eax, [esp + 0xc3c]
push eax
push edi
push 0
call fcn.0043b280
test al, al
je 0x434202
cmp word [esp + 0x18b8], 0
je 0x434202
lea ecx, [esp + 0x18b8]
push ecx
lea edx, [esp + 0x103c]
push edx
call fcn.00456820
push eax
call fcn.00478290
test eax, eax
je 0x434202
lea eax, [esp + 0x18b8]
push eax
push edi
call fcn.00456820
push eax
call fcn.00478290
test eax, eax
jne 0x434202
mov word [esp + 0x20d8], ax
xor esi, esi
jmp 0x4340c0
test ax, ax
jne 0x434134
push 0x400
push edi
lea ecx, [esp + 0x20e0]
push ecx
call fcn.004709a0
push esi
push str.rtmp_d
lea edx, [esp + 0x20e0]
push edx
call fcn.00456820
push eax
mov edx, 0x400
call fcn.00483770
add esp, 0xc
lea eax, [esp + 0x20d8]
push eax
push 0
call fcn.00435a70
test al, al
je 0x434118
xor eax, eax
mov word [esp + 0x20d8], ax
jmp 0x434120
mov ax, word [esp + 0x20d8]
add esi, 0x7b
cmp esi, 0x2710
jl 0x4340c0
test ax, ax
je 0x434202
push 0x400
push edi
lea ecx, [esp + 0x28e0]
push ecx
call fcn.004709a0
lea edx, [esp + 0x1038]
push edx
call fcn.00456820
mov esi, eax
lea eax, [esp + 0x28d8]
push eax
call fcn.00456820
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x434163
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x20d8]
push ecx
lea edx, [esp + 0x28dc]
push edx
call esi
test eax, eax
je 0x434202
lea ecx, [esp + 0x10]
call fcn.00434590
mov dword [esp + 0x30e4], 0
push edi
push 0
xor bl, bl
call fcn.00435a70
test al, al
jne 0x4341c2
push 9
push edi
push 0
lea ecx, [esp + 0x1c]
call fcn.00434b90
mov bl, al
lea eax, [esp + 0x28d8]
push eax
lea ecx, [esp + 0x20dc]
push ecx
call esi
test bl, bl
je 0x4341ea
lea ecx, [esp + 0x10]
call fcn.00434610
lea ecx, [esp + 0x10]
call fcn.004346c0
mov dword [esp + 0x30e4], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.004349a0
mov al, 1
jmp 0x434204
xor al, al
mov ecx, dword [esp + 0x30dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30c8]
xor ecx, esp
call fcn.004b102c
add esp, 0x30d8
ret 4
Function at 0x4349d0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x1c], 0
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0xc20], 0
jne 0x4349f3
test cl, 4
jne 0x4349f3
xor al, al
jmp 0x4349f5
mov al, 1
mov edx, ecx
shr edx, 1
and dl, 1
movzx esi, dl
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test cl, 1
je 0x434a1a
or esi, 0x40000000
mov ebx, 1
test al, al
je 0x434a28
mov ebx, 3
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov ebp, eax
call fcn.00444e60
test eax, eax
je 0x434a65
mov eax, dword [esp + 0x18]
test eax, eax
je 0x434a65
cmp word [eax], 0
je 0x434a65
push 0
push ebp
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [esp + 0x14]
jmp 0x434a79
push 0
push ebp
mov ebp, dword [esp + 0x1c]
push 3
push 0
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x434a95
mov dword [edi + 0xc20], 1
cmp esi, 0xffffffff
setne bl
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
test bl, bl
je 0x434b46
mov dword [edi + 4], esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x434ae8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x434ac2
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [edi + 0x41e]
push esi
push edx
call fcn.004b1d20
add esp, 0xc
jmp 0x434af1
xor eax, eax
mov word [edi + 0x41e], ax
test ebp, ebp
je 0x434b2c
mov eax, ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434b00
sub eax, edx
inc eax
push eax
lea ecx, [edi + 0x1d]
push ebp
push ecx
call fcn.004b1d20
mov eax, dword [edi + 4]
add esp, 0xc
push eax
mov ecx, edi
call fcn.004345e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc
push 0x1000000
lea edx, [edi + 0x1d]
push edx
push esi
call fcn.00477f10
mov eax, dword [edi + 4]
push eax
mov ecx, edi
call fcn.004345e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 0xc

Function at 0x434d10
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x434d37
cmp edi, 0x4e20
jbe 0x434d2c
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434da8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x434d86
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x434d6b
cmp eax, 3
jne 0x434d86
cmp edi, 0x4e20
jbe 0x434d86
push 0x4e20
push ebx
mov ecx, esi
call fcn.00434d10
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x434d9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x434d9f
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x4350d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x4352ee
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43510e
sub eax, 1
je 0x435103
sub eax, 1
jne 0x43510e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x435130
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x435130
mov ebx, dword [esp + 0x34]
jmp 0x435130
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x435184
xor edi, edi
test ebx, ebx
jbe 0x4351a9
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x435154
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x4351a9
add edi, 0x4000
cmp edi, ebx
jb 0x435144
jmp 0x4351a1
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x4352e8
cmp byte [esi + 0x14], 0
je 0x4352e8
cmp dword [esi + 0xc], 0
jne 0x4352e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.004347e0
mov ebx, eax
lea eax, [esi + 0x1d]
push eax
mov dword [esp + 0x2c], edx
call fcn.00435810
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x435239
ja 0x4351fa
cmp dword [esp + 0x1c], ebp
jbe 0x435239
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x435239
jl 0x435211
cmp edx, 0xffffffff
ja 0x435239
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x435239
jg 0x435224
cmp ecx, 0xffffffff
jbe 0x435239
lea edx, [esi + 0x41e]
push edx
lea eax, [esi + 0x1d]
push eax
mov ecx, 0x508304
call fcn.0042cf50
push 0
lea ebx, [esi + 0x41e]
push ebx
lea edi, [esi + 0x1d]
push edi
mov ecx, 0x508304
call fcn.0042cfd0
test al, al
je 0x4352cf
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x435120
test eax, eax
jbe 0x435120
mov ecx, esi
call fcn.004347e0
mov ecx, dword [esp + 0x10]
xor ebp, ebp
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebp
cmp ecx, 0xffffffff
je 0x435120
mov ebp, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebp, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x435120
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x435120
cmp byte [esi + 0x14], 0
je 0x435120
push ebx
push edi
mov ecx, 0x508304
call fcn.0042d0b0
jmp 0x435120
lea eax, [esi + 0x41e]
push eax
lea ecx, [esi + 0x1d]
push ecx
push 0
push 0
mov ecx, 0x508304
call fcn.0042d480
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x435710
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.00456630
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x43576c
cmp eax, 5
je 0x43576c
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004b102c
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.004b102c
add esp, 0x404
ret 4

Function at 0x435790
Capabilities:
Get disk information

Disassembly:
sub esp, 0x804
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
lea ecx, [esp]
push ecx
push eax
call fcn.00457c10
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4357ec
cmp eax, 5
je 0x4357ec
xor eax, eax
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004b102c
add esp, 0x804
ret 4
mov ecx, dword [esp + 0x800]
xor ecx, esp
mov eax, 1
call fcn.004b102c
add esp, 0x804
ret 4

Function at 0x435810
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00456630
cmp dword [0x505ce4], 0
jne 0x43586d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x435860
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x505ce4], eax
cmp dword [0x505ce4], 0
je 0x4358ee
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.00456d20
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x505ce4]
test eax, eax
je 0x4358ee
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x4358ee
push 1
push 0
push 0
push eax
call fcn.004b1ad0
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004b102c
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x43593b
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004b102c
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.004b102c
add esp, 0x42c
ret 4
Function at 0x435960
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00456630
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x435a4f
mov ecx, 0x4c9050
lea eax, [esp]
jmp 0x4359c0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4359e0
test dl, dl
je 0x4359dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4359e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4359c0
xor eax, eax
jmp 0x4359e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x435a33
mov ecx, 0x4c9048
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x435a11
test dl, dl
je 0x435a0d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x435a11
add eax, 2
add ecx, 2
test dl, dl
jne 0x4359f1
xor eax, eax
jmp 0x435a16
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x435a33
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004b102c
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004b102c
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004b102c
add esp, 0x50c
ret 4

Function at 0x435a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444e60
test eax, eax
je 0x435a9b
mov eax, dword [esp + 8]
test eax, eax
je 0x435a9b
cmp word [eax], 0
je 0x435a9b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x435ab7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435ab7
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x435ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00444e60
test eax, eax
je 0x435ae7
mov eax, dword [esp + 4]
test eax, eax
je 0x435ae7
cmp word [eax], 0
je 0x435ae7
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x435b40
Capabilities:
Get file attributes

Disassembly:
call fcn.00444e60
test eax, eax
je 0x435b61
mov eax, dword [esp + 8]
test eax, eax
je 0x435b61
cmp word [eax], 0
je 0x435b61
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x435b70
Capabilities:
Set file attributes

Disassembly:
call fcn.00444e60
test eax, eax
je 0x435b9b
mov eax, dword [esp + 8]
test eax, eax
je 0x435b9b
cmp word [eax], 0
je 0x435b9b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x435bb7
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x435bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
jmp 0x435be0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435be0
sub eax, edx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.004129c0
lea ecx, [esp + 0x10]
call fcn.00473e70
lea ecx, [esp + 0x10]
call fcn.00473c80
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004739d0
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x64
jle 0x435c29
mov eax, edi
jmp 0x435c3d
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push str._u._03u
push edx
call fcn.004b106b
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435c58
sub eax, edx
add eax, ebx
cmp eax, dword [esp + 0x74]
jae 0x435cbc
cmp esi, 0x3e8
je 0x435cbc
lea eax, [esp + 0x34]
mov edx, eax
mov ecx, ebp
sub ecx, edx
lea edx, [ecx + ebx]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x435c80
call fcn.00444e60
test ebp, ebp
je 0x435ca5
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x435ca5
inc esi
jmp 0x435c20
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004b102c
add esp, 0x5c
ret 8
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004b102c
add esp, 0x5c
ret 8

Function at 0x435ce0
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.00444e60
test eax, eax
je 0x435d6f
test esi, esi
je 0x435d2b
cmp word [esi], 0
jne 0x435d35
test edi, edi
je 0x435d6f
cmp word [edi], 0
je 0x435d6f
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.004566d0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.004566d0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x435d77
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004b102c
add esp, 0x1004
ret 0x10