joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e590
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4ae81b
mov eax, dword fs:[0]
push eax
mov eax, 0x24c4
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x24c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x24d4]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24e4]
mov esi, dword [esp + 0x24e8]
lea ecx, [esp + 0xc24]
call fcn.004680f0
lea ecx, [esp + 0xc48]
call fcn.004680f0
lea ecx, [esp + 0xc6c]
call fcn.004680f0
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
call fcn.004335f0
test al, al
je 0x42e7ab
cmp byte [esp + 0x10], 0
je 0x42e7ab
cmp byte [esp + 0xc90], 0
je 0x42e7ab
lea ecx, [esp + 0xc90]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0044daf0
push eax
call fcn.00465330
test eax, eax
je 0x42e7ab
lea eax, [esp + 0xc90]
push eax
push edi
call fcn.0044daf0
push eax
call fcn.00465330
test eax, eax
jne 0x42e7ab
xor esi, esi
lea ecx, [ecx]
push 0x400
push edi
lea ecx, [esp + 0x1cd8]
push ecx
call fcn.00465370
push esi
push str.rtmp_d
lea edx, [esp + 0x1cd8]
push edx
call fcn.0044daf0
push eax
call fcn.0049e635
add esp, 0xc
push 0
lea eax, [esp + 0x1cd4]
push eax
call fcn.0042fc80
test al, al
je 0x42e6bd
add esi, 0x7b
cmp esi, 0x2710
jl 0x42e670
push 0
lea ecx, [esp + 0x1cd4]
push ecx
call fcn.0042fc80
test al, al
jne 0x42e7ab
push 0x400
push edi
lea edx, [esp + 0x20d8]
push edx
call fcn.00465370
lea eax, [esp + 0x10]
push eax
call fcn.0044daf0
lea ecx, [esp + 0x20d0]
push ecx
mov esi, eax
call fcn.0044daf0
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x42e700
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x1cd0]
push edx
lea eax, [esp + 0x20d4]
push eax
call esi
test eax, eax
je 0x42e7ab
lea ecx, [esp + 0x10b0]
call fcn.0042ea90
mov dword [esp + 0x24dc], 0
push 0
push edi
xor bl, bl
call fcn.0042fc80
test al, al
jne 0x42e762
push 1
push 0
push edi
lea ecx, [esp + 0x10bc]
call fcn.0042efe0
mov bl, al
lea ecx, [esp + 0x20d0]
push ecx
lea edx, [esp + 0x1cd4]
push edx
call esi
test bl, bl
je 0x42e790
lea ecx, [esp + 0x10b0]
call fcn.0042eb10
lea ecx, [esp + 0x10b0]
call fcn.0042ebc0
mov dword [esp + 0x24dc], 0xffffffff
lea ecx, [esp + 0x10b0]
call fcn.0042ee50
mov al, 1
jmp 0x42e7ad
xor al, al
mov ecx, dword [esp + 0x24d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24c0]
xor ecx, esp
call fcn.0049e626
add esp, 0x24d0
ret 8
Function at 0x42ee80
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
push edi
mov dword [esi + 0xc18], 0
mov al, 1
jne 0x42ee9c
mov al, byte [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov dword [esp + 0x1c], CreateStatusWindowA
je 0x42eeb3
mov dword [esp + 0x1c], 0xc0000000
mov ebp, 1
test al, al
je 0x42eec1
mov ebp, 3
xor eax, eax
cmp byte [esi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0043cdb0
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x42ef02
test ebx, ebx
je 0x42ef02
cmp word [ebx], 0
je 0x42ef02
mov ecx, dword [esp + 0x1c]
push 0
push edi
push 3
push 0
push ebp
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [esp + 0x14]
jmp 0x42ef1a
mov edx, dword [esp + 0x1c]
push 0
push edi
push 3
push 0
push ebp
mov ebp, dword [esp + 0x28]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42ef36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x42ef36
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne al
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [esp + 0x1c], al
test al, al
je 0x42efa7
mov dword [esi + 4], edi
test ebx, ebx
je 0x42ef69
push ebx
lea eax, [esi + 0x418]
push eax
call fcn.0046db30
jmp 0x42ef72
xor ecx, ecx
mov word [esi + 0x418], cx
lea edx, [esi + 0x17]
test ebp, ebp
je 0x42ef8c
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42ef80
jmp 0x42ef98
push 0x1000000
push edx
push ebx
call fcn.0046d7f0
mov eax, dword [esi + 4]
push eax
mov ecx, esi
call fcn.0042eae0
mov al, byte [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x42f120
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x42f147
cmp edi, 0x4e20
jbe 0x42f13c
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42f1b8
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x42f196
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x42f17b
cmp eax, 3
jne 0x42f196
cmp edi, 0x4e20
jbe 0x42f196
push 0x4e20
push ebx
mov ecx, esi
call fcn.0042f120
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x42f1af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x42f1af
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x42f4a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x42f6a6
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42f4de
sub eax, 1
je 0x42f4d3
sub eax, 1
jne 0x42f4de
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x42f500
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x42f500
mov ebx, dword [esp + 0x34]
jmp 0x42f500
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x42f554
xor edi, edi
test ebx, ebx
jbe 0x42f579
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x42f524
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x42f579
add edi, 0x4000
cmp edi, ebx
jb 0x42f514
jmp 0x42f571
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x42f6a0
cmp byte [esi + 0x14], 0
je 0x42f6a0
cmp dword [esi + 0xc], 0
jne 0x42f6a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.0042ecc0
mov ebx, eax
lea eax, [esi + 0x17]
push eax
mov dword [esp + 0x2c], edx
call fcn.0042fb30
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x42f602
ja 0x42f5ca
cmp dword [esp + 0x1c], ebp
jbe 0x42f602
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x42f602
jl 0x42f5e1
cmp edx, 0xffffffff
ja 0x42f602
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x42f602
jg 0x42f5f4
cmp ecx, 0xffffffff
jbe 0x42f602
lea eax, [esi + 0x17]
push eax
mov ecx, 0x4c93ac
call fcn.00428230
push 0
lea edi, [esi + 0x17]
push edi
mov ecx, 0x4c93ac
call fcn.00428280
test al, al
je 0x42f690
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x42f4f0
test eax, eax
jbe 0x42f4f0
mov ecx, esi
call fcn.0042ecc0
mov ecx, dword [esp + 0x10]
xor ebx, ebx
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebx
cmp ecx, 0xffffffff
je 0x42f4f0
mov ebx, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebx, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42f4f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42f4f0
cmp byte [esi + 0x14], 0
je 0x42f4f0
push edi
mov ecx, 0x4c93ac
call fcn.00428340
jmp 0x42f4f0
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, 0x4c93ac
call fcn.00428650
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x42fab0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.0044da10
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x42fb0c
cmp eax, 5
je 0x42fb0c
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0049e626
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.0049e626
add esp, 0x404
ret 4

Function at 0x42fb30
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0044da10
cmp dword [0x4c7d8c], 0
jne 0x42fb8d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x42fb80
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c7d8c], eax
cmp dword [0x4c7d8c], 0
je 0x42fc0e
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.0044dfb0
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x4c7d8c]
test eax, eax
je 0x42fc0e
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x42fc0e
push 1
push 0
push 0
push eax
call fcn.0049f1e0
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0049e626
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x42fc5b
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.0049e626
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.0049e626
add esp, 0x42c
ret 4

Function at 0x42fc80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0043cdb0
test eax, eax
je 0x42fcab
mov eax, dword [esp + 8]
test eax, eax
je 0x42fcab
cmp word [eax], 0
je 0x42fcab
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8

Function at 0x42fd20
Capabilities:
Get file attributes

Disassembly:
call fcn.0043cdb0
test eax, eax
je 0x42fd41
mov eax, dword [esp + 8]
test eax, eax
je 0x42fd41
cmp word [eax], 0
je 0x42fd41
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8
Function at 0x42fd50
Capabilities:
Set file attributes

Disassembly:
call fcn.0043cdb0
test eax, eax
je 0x42fd7b
mov eax, dword [esp + 8]
test eax, eax
je 0x42fd7b
cmp word [eax], 0
je 0x42fd7b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc

Function at 0x42fef0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
jmp 0x42ff00
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ff00
sub eax, edx
mov ebx, eax
cmp ebx, 6
ja 0x42ff17
pop edi
xor eax, eax
pop ebx
ret 4
push ebp
push esi
call fcn.0049f4dd
mov ebp, eax
lea eax, [ebx + edi - 6]
xor esi, esi
mov dword [esp + 0x14], eax
lea ebx, [ebx + edi - 4]
mov edi, edi
lea eax, [esi + ebp]
cdq
mov ecx, 0xf4240
idiv ecx
push edx
mov edx, dword [esp + 0x18]
push str._06u
push edx
call fcn.0049e635
add esp, 0xc
mov byte [ebx], 0x2e
call fcn.0043cdb0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42ff6d
cmp esi, 0x3e8
je 0x42ff76
inc esi
jmp 0x42ff30
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
ret 4
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
ret 4

Function at 0x42ff90
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.0043cdb0
test eax, eax
je 0x43000a
test esi, esi
je 0x42ffdb
cmp word [esi], 0
jne 0x42ffe5
test edi, edi
je 0x43000a
cmp word [edi], 0
je 0x43000a
lea eax, [esp + 0x10]
push eax
push edi
push ebp
call fcn.0044dab0
push eax
lea ecx, [esp + 0x814]
push ecx
push esi
push ebx
call fcn.0044dab0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x430012
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x1004
ret 0x10
Function at 0x430210
Capabilities:
Delete file

Disassembly:
sub esp, 0xc2c
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0xc28], eax
push esi
mov esi, dword [esp + 0xc38]
push edi
mov edi, dword [esp + 0xc38]
call fcn.0043cdb0
test eax, eax
je 0x43027b
test esi, esi
je 0x43027b
cmp word [esi], 0
je 0x43027b
lea eax, [esp + 0x42c]
push eax
push esi
call fcn.0042fe30
lea ecx, [esp + 0x42c]
push ecx
call fcn.0046db10
xor edx, edx
mov word [esp + eax*2 + 0x42e], dx
lea eax, [esp + 0x42c]
push eax
call fcn.00430190
jmp 0x4302ea
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.0042fda0
lea eax, [esp + 0x28]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x430290
sub eax, edx
mov byte [esp + eax + 0x29], cl
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov word [esp + 0x24], ax
lea ecx, [esp + 8]
mov edx, 0x54
lea eax, [esp + 0x28]
push ecx
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], dx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0xc30]
pop edi
pop esi
xor ecx, esp
call fcn.0049e626
add esp, 0xc2c
ret 8

Function at 0x430380
Capabilities:
Delete directory

Disassembly:
sub esp, 0xc24
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0xc20], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc30]
push esi
push edi
mov edi, dword [esp + 0xc3c]
push ebp
lea ebx, [esp + 0x420]
lea esi, [esp + 0x14]
call fcn.00430310
test al, al
je 0x4303e1
call fcn.0043cdb0
test eax, eax
je 0x4303da
cmp word [esp + 0x41c], 0
je 0x4303da
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x430404
lea ecx, [esp + 0x10]
push ecx
jmp 0x4303fe
call fcn.0043cdb0
test eax, eax
je 0x4303fd
test edi, edi
je 0x4303fd
cmp word [edi], 0
je 0x4303fd
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x430404
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0xc30]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0xc24
ret 8

Function at 0x430520
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.0043cdb0
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x430548
test esi, esi
je 0x430548
cmp word [esi], 0
je 0x430548
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x430551
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x43056f
cmp byte [esp + 0x14], 0
je 0x430568
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.0042fd50
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x430584
cmp eax, 3
mov eax, 1
jne 0x430589
mov eax, 2
pop edi
pop esi
ret 0x10
Function at 0x4307e0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x830
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x844]
push ebx
mov ebx, dword [esp + 0x844]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
mov esi, dword [esp + 0x848]
push edi
mov edi, dword [esp + 0x848]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], eax
call fcn.0043cdb0
test eax, eax
je 0x430979
test esi, esi
je 0x430842
cmp dword [esi], 0
mov byte [esp + 0x12], 1
jne 0x430847
mov byte [esp + 0x12], 0
test ebx, ebx
je 0x430855
cmp dword [ebx], 0
mov byte [esp + 0x11], 1
jne 0x43085a
mov byte [esp + 0x11], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43086c
cmp dword [eax], 0
mov byte [esp + 0x13], 1
jne 0x430871
mov byte [esp + 0x13], 0
call fcn.0043cdb0
test eax, eax
je 0x430891
test edi, edi
je 0x430891
cmp word [edi], 0
je 0x430891
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x14], eax
jmp 0x43089c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x430994
test al, 1
je 0x430994
push 0
push edi
push ebp
mov bl, 1
call fcn.0042fd50
lea ecx, [esp + 0x3c]
push ecx
push edi
push ebp
call fcn.0044dab0
push 0
push 0x2000000
push 3
push 0
push 3
push 0x40000000
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x430979
cmp byte [esp + 0x12], 0
je 0x430901
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push eax
call fcn.00467e70
cmp byte [esp + 0x11], 0
je 0x430916
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00467e70
cmp byte [esp + 0x13], 0
je 0x43092b
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
call fcn.00467e70
movzx eax, byte [esp + 0x12]
movzx edx, byte [esp + 0x13]
neg eax
sbb eax, eax
lea ecx, [esp + 0x34]
and eax, ecx
movzx ecx, byte [esp + 0x11]
neg edx
push eax
sbb edx, edx
lea eax, [esp + 0x28]
and edx, eax
push edx
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x34]
and ecx, edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x430979
mov eax, dword [esp + 0x14]
push eax
push edi
push ebp
call fcn.0042fd50
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x830
ret 0x14
xor bl, bl
jmp 0x4308b8
Function at 0x4309a0
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ae8bb
mov eax, dword fs:[0]
push eax
mov eax, 0x1cac
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x1ca8], eax
push ebx
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x1cbc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1cd0]
mov edi, dword [esp + 0x1ccc]
push esi
push edi
call fcn.0044d8b0
test al, al
je 0x430a70
lea ecx, [esp + 0x10]
call fcn.00433040
mov dword [esp + 0x1cc4], 0
push edi
lea ecx, [esp + 0x14]
call fcn.00433080
push esi
lea ecx, [esp + 0x14]
call fcn.004330d0
lea ecx, [esp + 0x182c]
call fcn.004680f0
lea ecx, [esp + 0x1850]
call fcn.004680f0
lea ecx, [esp + 0x1874]
call fcn.004680f0
push 0
lea eax, [esp + 0xc1c]
push eax
lea ecx, [esp + 0x18]
call fcn.004334e0
mov bl, al
mov dword [esp + 0x1cc4], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00433060
mov al, bl
jmp 0x430a99
call fcn.0043cdb0
test eax, eax
je 0x430a8c
test esi, esi
je 0x430a8c
cmp word [esi], 0
je 0x430a8c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x430a93
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
mov ecx, dword [esp + 0x1cbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ca8]
xor ecx, esp
call fcn.0049e626
add esp, 0x1cb8
ret 8

Function at 0x430ad0
Capabilities:
Set file attributes

Disassembly:
call fcn.0043cdb0
test eax, eax
je 0x430af9
mov eax, dword [esp + 8]
test eax, eax
je 0x430af9
cmp word [eax], 0
je 0x430af9
mov dword [esp + 8], 0
mov dword [esp + 4], eax
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [esp + 8], 0
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
Function at 0x430b10
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4ae906
mov eax, dword fs:[0]
push eax
sub esp, 0x634
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x630], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x648]
mov dword fs:[0], eax
mov esi, dword [esp + 0x658]
push esi
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], esi
call fcn.0045ded0
xor ebp, ebp
mov dword [esp + 0x650], ebp
mov edi, 0x10000
push edi
call fcn.0049e6ff
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebp
jne 0x430b89
mov ecx, 0x4c93ac
call fcn.004285b0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x650], 1
mov ecx, esi
xor edi, edi
or ebx, 0xffffffff
call fcn.0042ed90
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp dword [0x4db884], edi
je 0x430bd9
lea eax, [esp + 0x44]
push eax
call fcn.0047f7a0
mov edx, dword [0x4db884]
push 0x200
lea ecx, [esp + 0x448]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
push 0
mov ecx, esi
call fcn.0042f3d0
jmp 0x430bf4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x65c]
cmp eax, 0x7fffffff
jne 0x430c0b
cmp dword [esp + 0x660], eax
je 0x430c1e
cmp dword [esp + 0x660], 0
jl 0x430c23
jg 0x430c1e
cmp eax, 0x10000
jbe 0x430c23
mov eax, 0x10000
push eax
mov eax, dword [esp + 0x24]
push eax
mov ecx, esi
call fcn.0042f6b0
mov esi, eax
test esi, esi
je 0x430ce3
add edi, 1
adc ebp, 0
mov eax, edi
and eax, 0xf
xor ecx, ecx
or eax, ecx
jne 0x430ca4
cmp dword [0x4db884], eax
je 0x430c9f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
push 0x10000
push ebp
push edi
call fcn.0049f1e0
push edx
push eax
call fcn.00464b30
push eax
push 0x51e
call fcn.0045be10
push eax
lea eax, [esp + 0x24c]
push eax
call fcn.0049e635
add esp, 0xc
lea ecx, [esp + 0x244]
push ecx
call fcn.0047f7c0
call fcn.0047ff60
call fcn.00465f90
mov edx, dword [esp + 0x20]
push esi
push edx
push ebx
call fcn.0041fbc0
mov ebx, eax
mov eax, 0x7fffffff
cmp dword [esp + 0x65c], eax
jne 0x430ccd
cmp dword [esp + 0x660], eax
je 0x430bf0
mov eax, esi
cdq
sub dword [esp + 0x65c], eax
sbb dword [esp + 0x660], edx
jmp 0x430bf0
cmp dword [0x4db884], 0
je 0x430d08
lea eax, [esp + 0x44]
push eax
call fcn.0047f7c0
lea ecx, [esp + 0x444]
push ecx
call fcn.0047f760
call fcn.0047ff60
not ebx
mov esi, ebx
mov byte [esp + 0x650], 0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x430d25
push eax
call fcn.0049e37d
add esp, 4
mov dword [esp + 0x650], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.0045df00
mov eax, esi
mov ecx, dword [esp + 0x648]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.0049e626
add esp, 0x640
ret 0x10