joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430f40
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.004b05b4
add esp, 0x10
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push edx
push ecx
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.004b0b88
add esp, 0x14
call fcn.0044b780
push 0x42
mov ecx, dword [ebp + 8]
push ecx
call fcn.00430b5c
add esp, 8
mov esi, eax
cmp esi, 0xffffffff
setne bl
and ebx, 1
test ebx, ebx
je 0x43105d
test edi, edi
jle 0x430fad
cmp dword [ebp + 0x10], 0
jge 0x430fb8
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetLocalTime
jmp 0x430fc8
push 0x10
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004cc638
add esp, 0xc
test edi, edi
jle 0x430fe4
mov cx, word [ebp - 4]
mov word [ebp - 0x3c], cx
mov ax, word [ebp - 8]
mov word [ebp - 0x3a], ax
mov dx, word [ebp - 0xc]
mov word [ebp - 0x36], dx
cmp dword [ebp + 0x10], 0
jl 0x43100a
mov cx, word [ebp - 0x10]
mov word [ebp - 0x34], cx
mov ax, word [ebp - 0x14]
mov word [ebp - 0x32], ax
mov dx, word [ebp - 0x18]
mov word [ebp - 0x30], dx
mov cx, word [ebp - 0x1c]
mov word [ebp - 0x2e], cx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x3c]
push edx
call sub.KERNEL32.DLL_SystemTimeToFileTime
test eax, eax
je 0x431049
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.DLL_LocalFileTimeToFileTime
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_SetFileTime
test eax, eax
setne bl
and ebx, 1
jmp 0x43104b
xor ebx, ebx
push 0
push ebx
call fcn.00432bb8
add esp, 8
push esi
call fcn.00430c1c
pop ecx
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43106c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0044b780
xor ebx, ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov dword [ebp - 4], eax
test esi, 1
mov edi, eax
je 0x431097
or ebx, 1
test esi, 2
je 0x4310a2
or ebx, 2
test esi, 4
je 0x4310ad
or ebx, 4
test esi, 0x20
je 0x4310b8
or ebx, 0x20
test ebx, ebx
jne 0x4310c1
mov ebx, 0x80
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00432bb8
add esp, 8
test edi, edi
je 0x4310eb
push edi
call fcn.00469a8c
pop ecx
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x431150
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0044b780
test di, di
je 0x431197
movzx ecx, di
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x431193
mov bx, word [ebp - 4]
jmp 0x4311a4
xor ebx, ebx
jmp 0x4311a4
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4311c4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0044b780
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4311f5
mov ebx, dword [ebp - 4]
jmp 0x4311f7
xor ebx, ebx
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x431218
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
xor ebx, ebx
call fcn.0044b780
test edi, edi
je 0x431264
push 0
lea eax, [ebp - 4]
push eax
push edi
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x43124f
mov ebx, dword [ebp - 4]
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
add esp, 8
jmp 0x431284
push 0
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x431294
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0044b780
call fcn.004b6124
test eax, eax
je 0x43130c
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004cc638
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00432bb8
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x431386
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x431353
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x431353
push 0
push 0
call fcn.00432bb8
add esp, 8
xor ebx, ebx
jmp 0x431386
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431394
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.0044b780
call fcn.004b6124
test eax, eax
je 0x43140c
xor eax, eax
mov dword [ebp - 4], eax
push 0x14
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.004cc638
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0x14], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x20]
push edx
push ecx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
push edx
call fcn.00432bb8
add esp, 8
mov ebx, dword [ebp - 4]
jmp 0x431486
mov eax, dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [ebp + 0x18]
and ebx, 0xffffffff
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push 0
push edx
push ebx
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x431453
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x431453
push 0
push 0
call fcn.00432bb8
add esp, 8
xor ebx, ebx
jmp 0x431486
xor eax, eax
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
push 0
push 0
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
add esp, 8
mov ebx, dword [ebp - 0xc]
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431a30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00430638
pop ecx
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x431a63
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x431a63
xor esi, esi
jmp 0x431a68
mov esi, 1
push 0
push esi
call fcn.00432bb8
add esp, 8
test esi, esi
je 0x431a92
mov eax, dword [ebp - 4]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, ebx
xor edx, edx
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
jmp 0x431a96
xor eax, eax
xor edx, edx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x431a9c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044b780
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
test esi, esi
je 0x431adf
push esi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x431ae8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004325e4
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
call fcn.0044b780
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
setne cl
and ecx, 1
mov ebx, ecx
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
test esi, esi
je 0x431b40
push esi
call fcn.00469a8c
pop ecx
test edi, edi
je 0x431b4b
push edi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x431b54
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044b780
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
test esi, esi
je 0x431b99
push esi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x431ba0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044b780
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
push edi
setne al
and eax, 1
mov ebx, eax
call sub.KERNEL32.DLL_SetErrorMode
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
test esi, esi
je 0x431bf3
push esi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x431bfc
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044b780
push ebx
call sub.KERNEL32.DLL_RemoveDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
test esi, esi
je 0x431c3f
push esi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x431c6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov byte [ebx], 0
cmp dword [ebp + 8], 0
jle 0x431ca3
call fcn.00431f10
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 4]
je 0x431ca3
mov ecx, dword [ebp + 8]
dec ecx
push ecx
call fcn.00431ec0
pop ecx
call fcn.0044b780
mov edi, dword [ebp + 0x10]
mov eax, edi
add eax, eax
push eax
call fcn.004699b8
pop ecx
mov esi, eax
mov word [esi], 0
push 0
push esi
push edi
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
push eax
call fcn.00432bb8
mov word [esi + edi*2 - 2], 0
add esp, 8
mov edx, dword [ebp + 0x10]
dec edx
push edx
push ebx
push esi
call fcn.0047747c
add esp, 0xc
push esi
call fcn.00469a8c
pop ecx
call fcn.0044b77c
call fcn.00432b7c
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
je 0x431d1a
mov edx, dword [ebp - 4]
dec edx
push edx
call fcn.00431ec0
pop ecx
push edi
call fcn.00432ba4
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ebx + ecx - 1], 0
test edi, edi
jne 0x431d9f
cmp byte [ebx], 0
je 0x431d9f
push ebx
call fcn.004cc770
pop ecx
mov dword [ebp - 8], ebx
mov esi, eax
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x431d47
add dword [ebp - 8], 2
sub esi, 2
mov edx, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [edx]
push ecx
push 0x59abdf
call fcn.004cc71c
add esp, 8
test eax, eax
je 0x431d64
inc dword [ebp - 8]
dec esi
test esi, esi
je 0x431d84
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + esi - 1]
push edx
push 0x59abdf
call fcn.004cc71c
add esp, 8
test eax, eax
je 0x431d84
dec esi
test esi, esi
je 0x431d9b
cmp ebx, dword [ebp - 8]
je 0x431d9b
push esi
mov ecx, dword [ebp - 8]
push ecx
push ebx
call fcn.004cc5ec
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x431da8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [esi], 0
call fcn.0044b780
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, edx
push edx
call fcn.004699b8
pop ecx
mov ebx, eax
mov word [ebx], 0
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCurrentDirectoryW
test eax, eax
setne dl
and edx, 1
mov edi, edx
push 0
push edi
call fcn.00432bb8
add esp, 8
mov eax, dword [ebp - 4]
mov word [ebx + eax*2 - 2], 0
mov edx, dword [ebp + 0xc]
dec edx
push edx
push esi
push ebx
call fcn.0047747c
add esp, 0xc
push ebx
call fcn.00469a8c
pop ecx
call fcn.0044b77c
mov ecx, dword [ebp + 0xc]
mov byte [esi + ecx - 1], 0
test edi, edi
je 0x431e5a
cmp byte [esi], 0
je 0x431e5a
push esi
call fcn.004cc770
pop ecx
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x431e5a
xor edx, edx
mov dl, byte [esi + ebx - 1]
push edx
push 0x59abdf
call fcn.004cc71c
add esp, 8
test eax, eax
jne 0x431e5a
mov byte [esi + ebx], 0x5c
inc ebx
mov byte [esi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x431e64
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
call fcn.0044b780
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov edi, eax
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
test eax, eax
setne al
and eax, 1
mov ebx, eax
push 0
push ebx
call fcn.00432bb8
add esp, 8
push edi
call sub.KERNEL32.DLL_SetErrorMode
call fcn.0044b77c
test esi, esi
je 0x431eb7
push esi
call fcn.00469a8c
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x432cb4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x432d95
test edi, edi
je 0x432d95
call fcn.0044b780
cmp dword [0x59abe8], 0
jne 0x432d01
push 0x59abf0
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x432d01
push str.CreateSymbolicLinkW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59abe8], eax
cmp dword [0x59abe8], 0
je 0x432d84
push edi
call fcn.004325e4
pop ecx
mov esi, eax
mov dword [ebp - 4], eax
push ebx
call fcn.004325e4
pop ecx
mov edi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x432d30
test al, 0x10
jne 0x432d34
xor edx, edx
jmp 0x432d39
mov edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x432d49
mov ecx, 1
jmp 0x432d4b
xor ecx, ecx
push ecx
push ebx
mov eax, dword [ebp - 4]
push eax
call dword [0x59abe8]
test eax, eax
setne dl
and edx, 1
mov ebx, edx
push 0
push ebx
call fcn.00432bb8
add esp, 8
test esi, esi
je 0x432d77
push esi
call fcn.00469a8c
pop ecx
test edi, edi
je 0x432d8e
push edi
call fcn.00469a8c
pop ecx
jmp 0x432d8e
push 1
call fcn.00432ba4
pop ecx
xor ebx, ebx
call fcn.0044b77c
jmp 0x432d9f
push 2
call fcn.00432ba4
pop ecx
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x432da8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
je 0x432ec3
call fcn.0044b780
cmp dword [0x59abec], 0
jne 0x432def
push 0x59abf0
call sub.KERNEL32.DLL_GetModuleHandleW
mov esi, eax
test esi, esi
je 0x432def
push str.GetFinalPathNameByHandleW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x59abec], eax
cmp dword [0x59abec], 0
je 0x432eb4
push ebx
call fcn.004325e4
pop ecx
mov esi, eax
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x432e16
test al, 0x10
jne 0x432e1a
xor edx, edx
jmp 0x432e1f
mov edx, 1
mov eax, edx
push 0
test eax, eax
je 0x432e2e
mov ecx, 0x2000010
jmp 0x432e33
mov ecx, 0x80
push ecx
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.DLL_CreateFileW
cmp eax, 0xffffffff
jne 0x432e58
push 0
push 0
call fcn.00432bb8
add esp, 8
jmp 0x432ea7
push 0
push 0x108
lea edx, [ebp - 0x210]
push edx
push eax
call dword [0x59abec]
cmp eax, 0x108
jae 0x432e9f
test eax, eax
jbe 0x432e91
mov word [ebp + eax*2 - 0x210], 0
lea eax, [ebp - 0x210]
push eax
call fcn.0047740c
pop ecx
mov edi, eax
push 0
push 1
call fcn.00432bb8
add esp, 8
jmp 0x432ea7
push 9
call fcn.00432ba4
pop ecx
test esi, esi
je 0x432ebc
push esi
call fcn.00469a8c
pop ecx
jmp 0x432ebc
push 1
call fcn.00432ba4
pop ecx
call fcn.0044b77c
jmp 0x432ecb
push 2
call fcn.00432ba4
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4332ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov byte [eax], 0
call fcn.0044b780
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x4332d9
push ebx
call fcn.004325e4
pop ecx
mov esi, eax
jmp 0x4332db
xor eax, eax
cmp dword [ebp + 0xc], 0
mov ebx, eax
je 0x4332fc
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
je 0x4332fc
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004325e4
pop ecx
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x433333
lea edx, [ebp - 0x424]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
jne 0x433321
push 0
push 0
call fcn.00432bb8
add esp, 8
xor eax, eax
jmp 0x433395
mov word [ebp - 0x216], 0
lea edx, [ebp - 0x424]
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x214]
push ecx
push 0
test ebx, ebx
jne 0x433345
mov ebx, 0x59ac7c
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
mov ebx, eax
test ebx, ebx
je 0x43336d
push 0x107
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.0047747c
add esp, 0xc
test esi, esi
je 0x433378
push esi
call fcn.00469a8c
pop ecx
test edi, edi
je 0x433383
push edi
call fcn.00469a8c
pop ecx
push 0
push ebx
call fcn.00432bb8
add esp, 8
call fcn.0044b77c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4333e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebx], 0
lea eax, [ebp - 0x210]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathW
test eax, eax
je 0x43342e
mov word [ebp - 2], 0
push 0x107
push ebx
lea eax, [ebp - 0x210]
xor esi, esi
push eax
call fcn.0047747c
add esp, 0xc
test esi, esi
jne 0x433457
cmp byte [ebx], 0
je 0x433457
push ebx
call fcn.004cc770
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x433462
cmp eax, 0x107
jge 0x433462
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x433462
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x434960
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x434a51
call sub.USER32.DLL_EmptyClipboard
cmp dword [ebp + 8], 0xd
jne 0x434999
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046f610
add esp, 0x10
mov esi, eax
jmp 0x4349b1
push 0
push 0
call fcn.0047705c
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046f538
add esp, 0x10
mov esi, eax
test esi, esi
je 0x434a47
cmp dword [ebp + 8], 0xd
lea eax, [esi + 1]
jne 0x4349c9
mov edx, 2
jmp 0x4349ce
mov edx, 1
imul edx
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test ebx, ebx
je 0x434a4c
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434a3b
cmp dword [ebp + 8], 0xd
jne 0x434a09
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046f610
add esp, 0x10
jmp 0x434a21
inc esi
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.0047705c
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046f538
add esp, 0x10
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
mov ecx, dword [ebp + 8]
push ecx
call sub.USER32.DLL_SetClipboardData
test eax, eax
setne al
and eax, 1
mov edi, eax
test edi, edi
jne 0x434a4c
push ebx
call sub.KERNEL32.DLL_GlobalFree
jmp 0x434a4c
mov edi, 1
call sub.USER32.DLL_CloseClipboard
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret