joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431cbf
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0xc], eax
call fcn.0042fd0f
mov esi, eax
xor edi, edi
test esi, esi
je 0x431e1e
mov ecx, esi
call fcn.004300a6
and al, 3
cmp al, 2
jne 0x431e1b
lea eax, [ebp - 8]
xor edx, edx
push eax
inc edx
mov ecx, esi
call fcn.004369e5
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x431e17
lea ecx, [esi + 8]
lea edx, [esi + 0xc]
call fcn.0043d257
mov ebx, eax
test ebx, ebx
je 0x431de3
push dword [esi + 0x10]
mov ecx, esi
push dword [esi + 8]
call fcn.00430246
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.0043d358
mov ebx, eax
test ebx, ebx
je 0x431de3
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], edi
and dword [ebp - 0x14], edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, esi
call fcn.004300a6
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov ecx, esi
call fcn.00430c21
mov edx, dword [ebp - 8]
add eax, 0x30
push eax
push ecx
push ecx
push 0
push ecx
mov ecx, dword [ebp - 0xc]
push 2
push ebx
call fcn.00437c43
mov ebx, eax
test ebx, ebx
je 0x431da5
mov ecx, esi
call fcn.004300a6
test al, 2
je 0x431dad
test byte [ebp - 0x10], 2
jne 0x431dad
push 2
pop edx
mov ecx, esi
call fcn.004301aa
jmp 0x431dad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [0x475b9c]
xor edx, edx
mov ecx, esi
push dword [0x475b98]
call fcn.00430aff
push edx
push eax
push ecx
mov ecx, esi
call fcn.00430253
mov ecx, eax
call fcn.004285e3
mov ecx, esi
call fcn.00430253
mov ecx, eax
call fcn.0042865f
jmp 0x431deb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x431e0c
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x431e17
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x431e1e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43394a
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [esp + 0x14], edx
push esi
mov eax, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
push edi
mov edi, ebx
mov dword [esp + 0x14], edi
test eax, eax
je 0x433b16
cmp edx, 0xffffffff
je 0x433b16
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x433a80
test byte [ecx + 0x28], 8
jne 0x433a80
call fcn.00430253
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
push ecx
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4339e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x4339d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x4339da
mov esi, 0x80004005
test esi, esi
js 0x433b06
push dword [esp + 0x24]
lea eax, [esp + 0x14]
push dword [esp + 0x24]
push 0x4071ec
push eax
call fcn.00423f05
mov ebx, dword [esp + 0x20]
mov esi, eax
add esp, 0x10
test esi, esi
js 0x433a1c
push ebx
push 0
push 0x4071f8
push dword [esp + 0x18]
call fcn.00456587
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x433a30
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0xc]
test esi, esi
js 0x433b06
mov ebx, dword [eax]
test ebx, ebx
je 0x433a84
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.0045965b
mov esi, eax
test esi, esi
js 0x433af1
push 0
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
lea eax, [esp + 0x1c]
push eax
sub esp, 0x10
lea esi, [esp + 0x3c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0045947d
mov edi, dword [esp + 0x14]
mov esi, eax
jmp 0x433a89
mov esi, ebx
jmp 0x433a34
mov esi, 0x80070057
test esi, esi
js 0x433af1
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x433a94
sub ecx, edx
mov dword [esp + 0x10], ebx
sar ecx, 1
lea eax, [esp + 0x10]
push ebx
push eax
lea esi, [ecx + ecx]
push esi
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x433aca
cmp dword [esp + 0x10], esi
jne 0x433aca
mov esi, ebx
jmp 0x433af3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x433aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x433af3
mov esi, 0x80004005
jmp 0x433af3
xor ebx, ebx
test edi, edi
je 0x433b06
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, esi
call fcn.00432b43
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x433b20
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43484d
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov dword [ebp - 0x14], ecx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edx
push esi
push edi
test ecx, ecx
je 0x434965
test eax, eax
je 0x434965
cmp dword [ebp + 8], edx
je 0x434965
mov edi, dword [ebp + 8]
xor eax, eax
push edx
push edx
push 0x40726c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov esi, eax
test esi, esi
js 0x43496a
push 0
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x407278
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov esi, eax
test esi, esi
js 0x434954
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x3fffffe9
add esi, 0xc0000017
test edi, edi
je 0x434954
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
js 0x434944
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
js 0x43493b
push 0
push 0x14
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ebp - 8]
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
test esi, esi
jns 0x434978
jmp 0x43496a
mov esi, 0xc000000d
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
not esi
shr esi, 0x1f
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x434d80
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x475280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x28], 0
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [0x47536c]
mov dword [ebp - 0x30], edx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x34], edi
cmp eax, 0xffffffff
jne 0x434e1b
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x4072b0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x434e01
cmp eax, 0x10
ja 0x434e01
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push 0x405d54
push eax
call dword [sym.imp.msvcrt.dll_swscanf_s]
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
test eax, eax
jg 0x434e07
mov ecx, dword [0x47536c]
mov edx, dword [ebp - 0x30]
lea eax, [ecx + 1]
mov edi, dword [ebp - 0x34]
neg eax
sbb eax, eax
and eax, ecx
mov dword [0x47536c], eax
mov ecx, dword [ebp + 8]
cmp ecx, 4
jne 0x434e2b
test eax, eax
je 0x434f04
push ebx
sub ecx, 1
je 0x434e53
sub ecx, 1
je 0x434e4c
sub ecx, 1
je 0x434e45
sub ecx, 1
mov ebx, 0x41009477
jmp 0x434e58
mov ebx, 0x41009484
jmp 0x434e58
mov ebx, 0x41009485
jmp 0x434e58
mov ebx, 0x4100947f
push edx
push edi
push dword [ebp + 0x20]
lea eax, [ebp - 0x28]
push dword [ebp - 0x38]
push 0x4072d8
push eax
call fcn.00423f05
mov edi, esi
add esp, 0x18
and edi, 0x10000000
cmp dword [ebp - 0x28], 0
je 0x434ece
test edi, edi
je 0x434e9a
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x434eab
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x434ead
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, si
je 0x434ead
mov eax, esi
push ecx
mov ecx, dword [ebp - 0x3c]
mov edx, ebx
push eax
push dword [ebp - 0x28]
call fcn.00429ea7
push dword [ebp - 0x28]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
test edi, edi
je 0x434eec
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x434efd
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x434efd
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x434efd
movzx esi, si
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00471d10
leave
ret 0x1c
Function at 0x436a84
Capabilities:
Clear file content
Delete file

Disassembly:
push 0x18
push 0x474530
call fcn.00472398
mov esi, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
xor edi, edi
test esi, esi
je 0x436aa8
cmp esi, 0xffffffff
je 0x436aa8
mov ebx, dword [ebp + 8]
jmp 0x436ab3
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x436bd1
test ebx, ebx
je 0x436bab
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
or edx, 0xffffffff
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x436adb
mov edx, dword [ecx]
cmp edx, 0xfeedf002
jne 0x436ba5
test eax, eax
je 0x436ba5
mov ecx, ebx
call fcn.00430fd0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
test eax, eax
je 0x436ba9
test esi, esi
je 0x436b0c
cmp esi, 0xffffffff
jne 0x436b2d
push edi
push 0x80
push 3
push edi
push 7
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x436ba0
mov esi, eax
mov dword [ebp - 0x24], eax
push edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x436ba0
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x436ba0
mov ecx, dword [ebp - 0x20]
call fcn.004305f7
mov ebx, eax
mov dword [ebp - 0x28], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x20]
call fcn.004305b8
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov edx, ecx
mov ecx, dword [ebp - 0x20]
call fcn.004305d7
mov dword [ebp - 4], 0xfffffffe
call fcn.00436b98
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ebx, edi
jmp 0x436bab
mov edi, dword [ebp - 0x1c]
jmp 0x436bab
mov edi, eax
jmp 0x436bab
mov edi, ecx
test esi, esi
je 0x436bbb
cmp esi, 0xffffffff
je 0x436bbb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x436bc6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x436bd1
mov ecx, edi
call fcn.00436be3
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4388a5
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x475280]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
xor eax, eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x34], ecx
lea edi, [ebp - 0x30]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4388e4
and eax, 0x3127
or eax, 0x80
mov dword [ebp - 0x10], eax
test ebx, ebx
je 0x4388f3
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
test esi, esi
je 0x438902
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
test edx, edx
je 0x438911
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
push 4
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x438939
mov esi, eax
or esi, 0x10000000
cmp eax, 0xc000000d
jne 0x43893b
xor esi, esi
test esi, esi
jns 0x43894f
push esi
push 0x690
mov ecx, 0x407560
call fcn.0043f87d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00471d10
leave
ret 0x10
Function at 0x43e3cc
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
xor esi, esi
test edi, edi
je 0x43e427
cmp word [edi], si
je 0x43e427
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push 0x6200000
push 3
push esi
push 7
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43e412
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
jne 0x43e423
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43e423
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x43e431
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
ret

Function at 0x43e560
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor eax, eax
mov esi, edx
mov ebx, eax
push edi
or edi, 0xffffffff
mov dword [ebp - 4], ebx
call fcn.004302a1
mov dword [ebp - 8], eax
test eax, eax
je 0x43e68c
mov ecx, dword [eax]
test ecx, ecx
je 0x43e68c
mov edx, 0x40493c
call fcn.00423d6b
test eax, eax
je 0x43e68c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x43e68c
xor eax, eax
push eax
push 0x2200000
push 3
push eax
push 7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x43e668
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.0043e434
mov esi, eax
test esi, esi
jns 0x43e5fe
push esi
push 0x3f5
mov ecx, 0x407e5c
call fcn.0043f87d
mov ebx, dword [ebp - 4]
jmp 0x43e68f
mov eax, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [eax]
mov edi, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, bx
jne 0x43e60a
mov ebx, dword [ebp - 4]
sub edi, ecx
mov ecx, ebx
sar edi, 1
call fcn.00423d6b
test eax, eax
je 0x43e65a
movzx ecx, word [ebx + edi*2]
push 0x5c
pop edx
cmp dx, cx
je 0x43e64e
push 0x3a
pop eax
cmp ax, cx
je 0x43e64e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dx, word [eax + edi*2 - 2]
je 0x43e64e
xor eax, eax
cmp ax, cx
jne 0x43e65a
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [ebp - 0xc]
mov dword [eax], ecx
jmp 0x43e691
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
mov dword [eax], 1
jmp 0x43e68f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
test esi, esi
jns 0x43e6b0
push esi
push 0x413
mov ecx, 0x407e5c
call fcn.0043f87d
jmp 0x43e68f
xor esi, esi
inc esi
xor ecx, ecx
test ebx, ebx
je 0x43e6a4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xffffffff
je 0x43e6b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x43e6b9
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], edx
push edi
push eax
push eax
mov esi, eax
mov dword [ebp - 0x20], eax
mov edi, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
mov ebx, ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x43e72b
push 3
call fcn.00411710
mov esi, eax
test esi, esi
jns 0x43e708
push esi
push 0x57f
mov ecx, 0x407ed4
call fcn.0043f87d
push 0x580
push 0x407ed4
push esi
push 0x407e90
push dword [ebp + 8]
push ebx
push 1
call fcn.00434d80
test esi, esi
js 0x43e86e
push 0
push 0x2200000
push 3
push 0
push 7
push 0x1f0000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x43e786
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x43e76d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x43e772
mov esi, 0x80004005
test esi, esi
jns 0x43e78e
push esi
push 0x590
mov ecx, 0x407ed4
call fcn.0043f87d
test esi, esi
js 0x43e862
movzx eax, word [ebp - 0x18]
add eax, 0x10
push eax
push 8
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x43e829
push dword [ebp - 8]
push 0
push edi
call sub.msvcrt.dll_memset
and dword [edi + 4], 0
mov byte [edi], 1
movzx eax, word [ebp - 0x18]
mov dword [edi + 8], eax
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x14]
lea eax, [edi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0x20]
push 0xa
push dword [ebp - 8]
push edi
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x43e862
mov esi, eax
or esi, 0x10000000
jge 0x43e80a
push esi
push 0x5ab
mov ecx, 0x407ed4
call fcn.0043f87d
push 0x5ac
push 0x407ed4
push esi
push 0x407eec
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
call fcn.00434d80
jmp 0x43e862
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
test eax, eax
jns 0x43e849
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411710
mov esi, eax
jmp 0x43e84e
mov esi, 0x80004005
test esi, esi
jns 0x43e862
push esi
push 0x5b2
mov ecx, 0x407ed4
call fcn.0043f87d
cmp ebx, 0xffffffff
je 0x43e86e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x43e888
push dword [ebp - 0x14]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
je 0x43e89c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x43ef0d
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x475280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x624], eax
mov esi, edx
inc edi
call fcn.0043ee56
mov dword [ebp - 0x628], eax
test eax, eax
je 0x43efeb
mov ecx, dword [ebp - 0x624]
or dword [ebp - 0x620], 0xffffffff
call fcn.0043037c
lea ecx, [ebp - 0x620]
mov edx, 0xc11d0131
push ecx
push dword [ebp - 0x628]
mov ecx, eax
push 0x10
push 0x204021
push 3
call fcn.00446cae
mov esi, eax
mov eax, dword [ebp - 0x620]
test ebx, ebx
je 0x43ef8d
mov dword [ebx], eax
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x43ef99
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x43efd8
test esi, 0x10000000
je 0x43efbe
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x43efcf
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x43efcf
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x43efcf
movzx esi, si
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00471d10
leave
ret 4
push 0x618
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
pop ecx
pop ecx
mov ecx, dword [ebp - 0x624]
lea eax, [ebp - 0x61c]
push eax
mov edx, esi
call fcn.0043d9c7
test eax, eax
je 0x43f01e
lea esi, [ebp - 0x61c]
mov ecx, esi
call fcn.0042181d
test eax, eax
jne 0x43f037
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test edi, edi
je 0x43efd8
test ebx, ebx
je 0x43efd8
push 0
push 0x2200000
push 3
push 0
push 7
push 0xc11d0131
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43efd6
mov dword [ebx], eax
jmp 0x43efd8

Function at 0x43f1e2
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
mov edi, edx
push esi
lea edx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.0042fd2c
mov ebx, 0x10000000
test dword [ebp - 4], ebx
je 0x43f218
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, edi
call fcn.00446e31
mov esi, eax
jmp 0x43f24b
push 0xb
push dword [ebp + 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push eax
push edi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x43f24b
mov esi, eax
or esi, ebx
jge 0x43f24b
push esi
push 0x93e
mov ecx, 0x408004
call fcn.0043f87d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc