joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428dd0
Capabilities:
Delete file
Log keystrokes via polling
Move file

Disassembly:
mov eax, 0x1050
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x104c], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
mov esi, ecx
mov eax, dword [esi]
push 0x110a
push eax
call edi
test eax, eax
je 0x428ef5
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x113e
push edx
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], eax
call edi
test eax, eax
je 0x428ef5
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x428ef5
mov edx, dword [eax + 8]
lea ecx, [esp + 0x854]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x428ef5
push ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
push 0x400
shr ebx, 0xf
lea eax, [esp + 0x85c]
push eax
lea ecx, [esp + 0x5c]
not bl
push ecx
and bl, 1
call fcn.0046f260
lea eax, [esp + 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428e85
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x56], dx
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
movzx eax, bl
neg eax
sbb eax, eax
lea edx, [esp + 0xc]
and eax, 0x40
lea ecx, [esp + 0x54]
push edx
mov dword [esp + 0x14], 3
mov word [esp + 0x20], ax
mov dword [esp + 0x18], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
movzx eax, byte [esi + 8]
push eax
mov ecx, esi
call fcn.00428cf0
pop ebx
mov ecx, dword [esp + 0x1054]
pop edi
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x1050
ret
Function at 0x429720
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [esp + 0x1014]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4297e8
push 0x400
lea eax, [esp + 0xc]
push eax
push edi
push esi
call fcn.004559f0
lea eax, [esp + 8]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429770
sub eax, edx
lea ecx, [esp + 8]
sar eax, 1
push ecx
mov esi, eax
call fcn.00456e50
test al, al
jne 0x4297c3
lea edx, [esp + 0x808]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [esp + 0x808]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4297b0
sub eax, edx
sar eax, 1
lea esi, [esi + eax + 1]
cmp esi, 0x104
jbe 0x4297e8
push 0x104
push 0x564
call fcn.00465ec0
push eax
push 0x4c6d1c
call fcn.00498be0
add esp, 0xc
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x1004
ret 8
Function at 0x4309a0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4c232b
mov eax, dword fs:[0]
push eax
mov eax, 0x30c4
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x30c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x30d4]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30e4]
lea ecx, [esp + 0x1844]
call fcn.00472370
lea ecx, [esp + 0x1868]
call fcn.00472370
lea ecx, [esp + 0x188c]
call fcn.00472370
push 0
lea eax, [esp + 0xc34]
push eax
push edi
push 0
call fcn.00437b50
test al, al
je 0x430bc2
cmp word [esp + 0x18b0], 0
je 0x430bc2
lea ecx, [esp + 0x18b0]
push ecx
lea edx, [esp + 0x1034]
push edx
call fcn.00455b40
push eax
call fcn.00477c80
test eax, eax
je 0x430bc2
lea eax, [esp + 0x18b0]
push eax
push edi
call fcn.00455b40
push eax
call fcn.00477c80
test eax, eax
jne 0x430bc2
mov word [esp + 0x20d0], ax
xor esi, esi
jmp 0x430a80
test ax, ax
jne 0x430af4
push 0x400
push edi
lea ecx, [esp + 0x20d8]
push ecx
call fcn.0046f260
push esi
push str.rtmp_d
lea edx, [esp + 0x20d8]
push edx
call fcn.00455b40
push eax
mov edx, 0x400
call fcn.004a5ca0
add esp, 0xc
lea eax, [esp + 0x20d0]
push eax
push 0
call fcn.004323d0
test al, al
je 0x430ad8
xor eax, eax
mov word [esp + 0x20d0], ax
jmp 0x430ae0
mov ax, word [esp + 0x20d0]
add esi, 0x7b
cmp esi, 0x2710
jl 0x430a80
test ax, ax
je 0x430bc2
push 0x400
push edi
lea ecx, [esp + 0x28d8]
push ecx
call fcn.0046f260
lea edx, [esp + 0x1030]
push edx
call fcn.00455b40
mov esi, eax
lea eax, [esp + 0x28d0]
push eax
call fcn.00455b40
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x430b23
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x20d0]
push ecx
lea edx, [esp + 0x28d4]
push edx
call esi
test eax, eax
je 0x430bc2
lea ecx, [esp + 0x10]
call fcn.00430f40
mov dword [esp + 0x30dc], 0
push edi
push 0
xor bl, bl
call fcn.004323d0
test al, al
jne 0x430b82
push 1
push edi
push 0
lea ecx, [esp + 0x1c]
call fcn.00431540
mov bl, al
lea eax, [esp + 0x28d0]
push eax
lea ecx, [esp + 0x20d4]
push ecx
call esi
test bl, bl
je 0x430baa
lea ecx, [esp + 0x10]
call fcn.00430fe0
lea ecx, [esp + 0x10]
call fcn.00431090
mov dword [esp + 0x30dc], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00431370
mov al, 1
jmp 0x430bc4
xor al, al
mov ecx, dword [esp + 0x30d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30c0]
xor ecx, esp
call fcn.004aedbb
add esp, 0x30d0
ret 4
Function at 0x4313a0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x16], 0
mov dword [edi + 0xc18], 0
mov al, 1
jne 0x4313bc
mov al, byte [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
je 0x4313d3
mov dword [esp + 0x1c], 0xc0000000
mov ebp, 1
test al, al
je 0x4313e1
mov ebp, 3
xor eax, eax
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov esi, eax
call fcn.00442d90
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x431422
test ebx, ebx
je 0x431422
cmp word [ebx], 0
je 0x431422
mov ecx, dword [esp + 0x1c]
push 0
push esi
push 3
push 0
push ebp
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [esp + 0x14]
jmp 0x43143a
mov edx, dword [esp + 0x1c]
push 0
push esi
push 3
push 0
push ebp
mov ebp, dword [esp + 0x28]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x431456
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x431456
mov dword [edi + 0xc18], 1
cmp esi, 0xffffffff
setne al
mov byte [edi + 0x12], 0
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov byte [esp + 0x1c], al
test al, al
je 0x4314f0
mov dword [edi + 4], esi
test ebx, ebx
je 0x4314a6
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431480
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [edi + 0x418]
push ebx
push ecx
call fcn.004afea0
add esp, 0xc
jmp 0x4314af
xor edx, edx
mov word [edi + 0x418], dx
test ebp, ebp
je 0x4314d2
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4314b8
sub eax, edx
inc eax
push eax
lea eax, [edi + 0x17]
push ebp
push eax
call fcn.004afea0
add esp, 0xc
jmp 0x4314e1
push 0x1000000
lea ecx, [edi + 0x17]
push ecx
push ebx
call fcn.00477920
mov edx, dword [edi + 4]
push edx
mov ecx, edi
call fcn.00430f90
mov al, byte [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x431690
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x4316b7
cmp edi, 0x4e20
jbe 0x4316ac
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431728
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x431706
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4316eb
cmp eax, 3
jne 0x431706
cmp edi, 0x4e20
jbe 0x431706
push 0x4e20
push ebx
mov ecx, esi
call fcn.00431690
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x43171f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x43171f
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x431a30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x431c4e
mov eax, dword [esi + 0xc]
test eax, eax
je 0x431a6e
sub eax, 1
je 0x431a63
sub eax, 1
jne 0x431a6e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x431a90
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x431a90
mov ebx, dword [esp + 0x34]
jmp 0x431a90
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x431ae4
xor edi, edi
test ebx, ebx
jbe 0x431b09
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x431ab4
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x431b09
add edi, 0x4000
cmp edi, ebx
jb 0x431aa4
jmp 0x431b01
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x431c48
cmp byte [esi + 0x14], 0
je 0x431c48
cmp dword [esi + 0xc], 0
jne 0x431c48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.004311b0
mov ebx, eax
lea eax, [esi + 0x17]
push eax
mov dword [esp + 0x2c], edx
call fcn.00432170
push edi
mov dword [esp + 0x20], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x431b99
ja 0x431b5a
cmp dword [esp + 0x1c], ebp
jbe 0x431b99
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x431b99
jl 0x431b71
cmp edx, 0xffffffff
ja 0x431b99
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x18], eax
js 0x431b99
jg 0x431b84
cmp ecx, 0xffffffff
jbe 0x431b99
lea edx, [esi + 0x418]
push edx
lea eax, [esi + 0x17]
push eax
mov ecx, 0x513904
call fcn.00429b40
push 0
lea ebx, [esi + 0x418]
push ebx
lea edi, [esi + 0x17]
push edi
mov ecx, 0x513904
call fcn.00429bc0
test al, al
je 0x431c2f
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x431a80
test eax, eax
jbe 0x431a80
mov ecx, esi
call fcn.004311b0
mov ecx, dword [esp + 0x10]
xor ebp, ebp
sub eax, ecx
mov ecx, dword [esi + 4]
sbb edx, ebp
cmp ecx, 0xffffffff
je 0x431a80
mov ebp, edx
push 0
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
sar ebp, 0x1f
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x431a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x431a80
cmp byte [esi + 0x14], 0
je 0x431a80
push ebx
push edi
mov ecx, 0x513904
call fcn.00429ca0
jmp 0x431a80
lea eax, [esi + 0x418]
push eax
lea ecx, [esi + 0x17]
push ecx
push 0
push 0
mov ecx, 0x513904
call fcn.0042a070
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x432070
Capabilities:
Get disk information

Disassembly:
sub esp, 0x404
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
lea ecx, [esp]
push ecx
push eax
call fcn.00455950
movsx edx, byte [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x4320cc
cmp eax, 5
je 0x4320cc
xor eax, eax
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004aedbb
add esp, 0x404
ret 4
mov ecx, dword [esp + 0x400]
xor ecx, esp
mov eax, 1
call fcn.004aedbb
add esp, 0x404
ret 4

Function at 0x4320f0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
lea ecx, [esp]
push ecx
push eax
call fcn.00456f30
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x43214c
cmp eax, 5
je 0x43214c
xor eax, eax
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret 4
mov ecx, dword [esp + 0x800]
xor ecx, esp
mov eax, 1
call fcn.004aedbb
add esp, 0x804
ret 4

Function at 0x432170
Capabilities:
Get disk size

Disassembly:
sub esp, 0x42c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x428], eax
push esi
mov esi, dword [esp + 0x434]
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00455950
cmp dword [0x5112e4], 0
jne 0x4321cd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4321c0
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5112e4], eax
cmp dword [0x5112e4], 0
je 0x43224e
push 0x400
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.00456040
lea edx, [esp + 0x1c]
push edx
movsx edx, byte [esp + 0x30]
lea eax, [esp + 0x28]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x34]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [0x5112e4]
test eax, eax
je 0x43224e
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x20]
ja 0x43224e
push 1
push 0
push 0
push eax
call fcn.004afc40
mov ecx, dword [esp + 4]
xor esi, esi
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004aedbb
add esp, 0x42c
ret 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
movsx eax, byte [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
neg eax
lea edx, [esp + 0x20]
sbb eax, eax
lea ecx, [esp + 0x38]
push edx
and eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x43229b
mov eax, 0x163e00
xor edx, edx
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004aedbb
add esp, 0x42c
ret 4
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x42c]
mul dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x42c
ret 4
Function at 0x4322c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x508], eax
mov eax, dword [esp + 0x510]
lea ecx, [esp + 0x108]
push ecx
push eax
call fcn.00455950
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4323af
mov ecx, 0x4c7040
lea eax, [esp]
jmp 0x432320
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432340
test dl, dl
je 0x43233c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432340
add eax, 2
add ecx, 2
test dl, dl
jne 0x432320
xor eax, eax
jmp 0x432345
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x432393
mov ecx, 0x4c7038
lea eax, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x432371
test dl, dl
je 0x43236d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x432371
add eax, 2
add ecx, 2
test dl, dl
jne 0x432351
xor eax, eax
jmp 0x432376
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x432393
xor eax, eax
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004aedbb
add esp, 0x50c
ret 4
mov eax, 1
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.004aedbb
add esp, 0x50c
ret 4
mov ecx, dword [esp + 0x508]
xor ecx, esp
xor al, al
call fcn.004aedbb
add esp, 0x50c
ret 4

Function at 0x4323d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00442d90
test eax, eax
je 0x4323fb
mov eax, dword [esp + 8]
test eax, eax
je 0x4323fb
cmp word [eax], 0
je 0x4323fb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
mov eax, dword [esp + 4]
test eax, eax
je 0x432417
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x432417
mov eax, 1
ret 8
xor eax, eax
ret 8

Function at 0x432420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00442d90
test eax, eax
je 0x432447
mov eax, dword [esp + 4]
test eax, eax
je 0x432447
cmp word [eax], 0
je 0x432447
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret 4
xor al, al
ret 4

Function at 0x4324b0
Capabilities:
Get file attributes

Disassembly:
call fcn.00442d90
test eax, eax
je 0x4324d1
mov eax, dword [esp + 8]
test eax, eax
je 0x4324d1
cmp word [eax], 0
je 0x4324d1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret 8
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x4324e0
Capabilities:
Set file attributes

Disassembly:
call fcn.00442d90
test eax, eax
je 0x43250b
mov eax, dword [esp + 8]
test eax, eax
je 0x43250b
cmp word [eax], 0
je 0x43250b
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x432527
mov edx, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
xor al, al
ret 0xc
Function at 0x432530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x5c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
jmp 0x432550
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432550
sub eax, edx
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00472370
lea ecx, [esp + 0x10]
call fcn.00472640
lea ecx, [esp + 0x10]
call fcn.00472480
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004721c0
mov ecx, edi
shr ecx, 0xa
xor eax, ecx
xor edi, eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x64
jle 0x432599
mov eax, edi
jmp 0x4325ad
mov eax, 0x10624dd3
mul edi
shr edx, 6
imul edx, edx, 0x3e8
mov eax, edi
sub eax, edx
push eax
push esi
lea edx, [esp + 0x3c]
push str._u._03u
push edx
call fcn.004aedca
lea eax, [esp + 0x44]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4325c8
sub eax, edx
add eax, ebx
cmp eax, dword [esp + 0x74]
jae 0x43262c
cmp esi, 0x3e8
je 0x43262c
lea eax, [esp + 0x34]
mov edx, eax
mov ecx, ebp
sub ecx, edx
lea edx, [ecx + ebx]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4325f0
call fcn.00442d90
test ebp, ebp
je 0x432615
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x432615
inc esi
jmp 0x432590
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004aedbb
add esp, 0x5c
ret 8
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004aedbb
add esp, 0x5c
ret 8

Function at 0x432650
Capabilities:
Move file

Disassembly:
mov eax, 0x1004
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
mov ebp, dword [esp + 0x1018]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1024]
call fcn.00442d90
test eax, eax
je 0x4326df
test esi, esi
je 0x43269b
cmp word [esi], 0
jne 0x4326a5
test edi, edi
je 0x4326df
cmp word [edi], 0
je 0x4326df
push 0x400
lea eax, [esp + 0x814]
push eax
push esi
push ebx
call fcn.004559f0
push 0x400
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
call fcn.004559f0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4326e7
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
test eax, eax
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x1004
ret 0x10
Function at 0x432c10
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
push edi
call fcn.00442d90
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test eax, eax
je 0x432c38
test esi, esi
je 0x432c38
cmp word [esi], 0
je 0x432c38
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x432c45
test edi, edi
je 0x432c78
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x432c63
cmp byte [esp + 0x14], 0
je 0x432c5c
mov eax, dword [esp + 0x18]
push eax
push esi
push edi
call fcn.004324e0
pop edi
xor eax, eax
pop esi
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x432c78
cmp eax, 3
mov eax, 1
jne 0x432c7d
mov eax, 2
pop edi
pop esi
ret 0x10

Function at 0x432c90
Capabilities:
Create directory

Disassembly:
sub esp, 0x408
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x404], eax
push ebp
mov ebp, dword [esp + 0x410]
test ebp, ebp
je 0x432dbd
cmp byte [ebp], 0
je 0x432dbd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
mov byte [esp + 0xf], 1
mov edi, ebp
push esi
mov edi, edi
mov esi, edi
sub esi, ebp
cmp esi, 0x400
jge 0x432d40
cmp byte [edi], 0x5c
jne 0x432d22
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004b0850
add esp, 0xc
mov byte [esp + esi + 0x14], 0
call fcn.00442d90
push 0
lea ecx, [esp + 0x18]
push ecx
call ebx
test eax, eax
je 0x432d17
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.004324e0
jmp 0x432d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
cmp byte [0x562890], 0
je 0x432d3a
push edi
mov ecx, 0x562790
call fcn.00478100
mov edi, eax
jmp 0x432d3b
inc edi
cmp byte [edi], 0
jne 0x432cd0
cmp byte [esp + 0x420], 0
pop esi
jne 0x432d9f
push ebp
call fcn.00455ba0
movsx eax, byte [eax]
push eax
call fcn.00455490
test al, al
jne 0x432d9f
call fcn.00442d90
push 0
push ebp
call ebx
test eax, eax
je 0x432d94
push 0
push 0
push ebp
call fcn.004324e0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004aedbb
add esp, 0x408
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.004aedbb
add esp, 0x408
ret 8
mov ecx, dword [esp + 0x408]
pop ebp
xor ecx, esp
xor al, al
call fcn.004aedbb
add esp, 0x408
ret 8
Function at 0x432de0
Capabilities:
Create directory

Disassembly:
sub esp, 0x808
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
mov ebp, dword [esp + 0x810]
test ebp, ebp
je 0x432f14
cmp word [ebp], 0
je 0x432f14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov byte [esp + 0xf], 1
xor edi, edi
push esi
nop
mov esi, edi
sar esi, 1
cmp esi, 0x400
jge 0x432e8c
cmp word [edi + ebp], 0x5c
jne 0x432e82
push esi
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.004b09cc
xor ecx, ecx
add esp, 0xc
mov word [esp + esi*2 + 0x14], cx
call fcn.00442d90
test eax, eax
je 0x432e7d
cmp word [esp + 0x14], 0
je 0x432e7d
push 0
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x432e77
push 0
lea eax, [esp + 0x18]
push eax
push 0
call fcn.004324e0
jmp 0x432e82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x13], 0
add edi, 2
cmp word [edi + ebp], 0
jne 0x432e20
cmp byte [esp + 0x820], 0
pop esi
jne 0x432ef6
push ebp
call fcn.00455410
movzx ecx, word [eax]
push ecx
call fcn.00455490
test al, al
jne 0x432ef6
call fcn.00442d90
test eax, eax
je 0x432ef1
cmp word [ebp], 0
je 0x432ef1
push 0
push ebp
call ebx
test eax, eax
je 0x432eeb
push 0
push ebp
push 0
call fcn.004324e0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004aedbb
add esp, 0x808
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0xf], 0
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004aedbb
add esp, 0x808
ret 8
mov ecx, dword [esp + 0x808]
pop ebp
xor ecx, esp
xor al, al
call fcn.004aedbb
add esp, 0x808
ret 8