joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d77d0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x43cab5
mov eax, dword [edi]
jmp 0x43cab7
mov eax, edi
mov byte [eax], 0
cmp dword [ebp + 0x18], 0
jne 0x43cae1
push str.No_input_file_path_data
push 0
push 5
push str.AdobeGCVersionWrapper
push dword [0x679bc8]
call fcn.00496770
add esp, 0x14
jmp 0x43cc32
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00442a40
mov esi, eax
add esp, 4
test esi, esi
mov ecx, 0x63f7d8
cmovne ecx, esi
push ecx
lea ecx, [ebp - 0x28]
call fcn.00433230
push esi
mov byte [ebp - 4], 1
call fcn.0058d115
add esp, 4
cmp dword [ebp - 0x18], 0
jne 0x43cb2b
push str.Error_converting_ascii_path_to_wide_path
push 0
push 5
jmp 0x43cc0a
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x43cc1d
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00562e5a
mov esi, eax
add esp, 4
test esi, esi
je 0x43cc01
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, dword [ebp - 0x28]
push ebx
push dword [ebp - 0x30]
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x43cbd3
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0x6409e8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x43cbf6
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x43cbf6
movzx eax, word [ecx + 0xc]
mov dx, word [ecx + 8]
push edi
push eax
movzx eax, word [ecx + 0xe]
mov cx, word [ecx + 0xa]
push eax
call fcn.0043cc70
add esp, 0xc
push esi
call fcn.00562e55
add esp, 4
jmp 0x43cc1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_retrieving_version_for_file_:__d
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x679bc8]
call fcn.00496770
add esp, 0x18
push esi
call fcn.00562e55
add esp, 4
jmp 0x43cc1d
push str.Error_creating_memory_for_version
push 0
push 2
push str.AdobeGCVersionWrapper
push dword [0x679bc8]
call fcn.00496770
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x43cc32
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00433df0
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x43cc47
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00430ec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x43dd20
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7c22
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x43dd91
mov eax, dword [esi]
jmp 0x43dd93
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.00433660
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00579420
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x43de68
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00579420
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x43de47
xor ecx, ecx
jmp 0x43de59
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43de50
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.00433660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x43de90
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7c22
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x314], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x318], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x31c], esi
mov dword [esi + 0x10], 0
jb 0x43df01
mov eax, dword [esi]
jmp 0x43df03
mov eax, esi
xor ecx, ecx
mov byte [eax], 0
cmp byte [str.unknown], cl
mov eax, 7
cmove eax, ecx
mov ecx, esi
push eax
push str.unknown
call fcn.00433660
push 0x200
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x318], 1
call fcn.00579420
add esp, 0xc
mov dword [ebp - 0x314], 0x100
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x43dfd8
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00579420
add esp, 0xc
lea eax, [ebp - 0x110]
push 0
push 0
push 0x100
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x110], 0
jne 0x43dfb7
xor ecx, ecx
jmp 0x43dfc9
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43dfc0
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.00433660
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x43e7c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0xa30], edx
push ebx
xor ebx, ebx
mov dword [ebp - 0xa2c], eax
test eax, eax
je 0x43e94a
push 0x20a
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.00579420
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa28], ax
lea eax, [ebp - 0xa28]
push eax
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x1fe
ja 0x43e94a
mov eax, dword [0x641dd8]
push esi
mov dword [ebp - 0xc], eax
mov ax, word [0x641ddc]
push edi
mov word [ebp - 8], ax
lea edi, [ebp - 0xa28]
mov ax, word [edi]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x43e930
lea esi, [ebp - 0x214]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x43e870
sub esi, ecx
sar esi, 1
cmp esi, 0x104
jae 0x43e930
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0xa2c]
call fcn.0058e34d
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0xa2c]
jne 0x43e8b9
cmp word [eax + esi*2], 0x5c
jne 0x43e8b9
mov ebx, 1
jmp 0x43e8bb
xor ebx, ebx
test ebx, ebx
je 0x43e930
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s_s
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.0043d090
lea ecx, [ebp - 0x41c]
add esp, 0x14
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e8f0
sub ecx, edx
lea eax, [ebp - 0x41c]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.0058e5d3
mov ecx, dword [ebp - 0xa30]
lea eax, [ebp - 0x628]
add esp, 0x10
push eax
call fcn.004334d0
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x43e930
test ebx, ebx
jne 0x43e948
cmp word [edi], bx
jne 0x43e842
pop edi
pop esi
mov ecx, dword [ebp - 4]
test ebx, ebx
pop ebx
setne al
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x441c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d78e6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x66c214]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00562e63
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00564dd3
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x442ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x442f6d
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00442aa0
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x442f13
sub ecx, edx
je 0x442f29
cmp byte [ecx + esi - 1], 0x5c
jne 0x442f29
mov byte [ecx + esi - 1], al
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x442f30
sub edx, ecx
or ecx, 0xffffffff
cmp edx, 0x104
cmovb ecx, edx
push ecx
push esi
push 0x104
push edi
call fcn.0058e951
push esi
call fcn.0058d115
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00562e44
mov esp, ebp
pop ebp
ret

Function at 0x442fc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00442a40
mov edi, eax
add esp, 4
test edi, edi
je 0x442fed
push esi
push edi
call fcn.0058f008
push edi
mov esi, eax
call fcn.0058d115
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebp
ret
push 0x16
call fcn.0058f9c1
add esp, 4
or eax, 0xffffffff
pop edi
pop ebp
ret
Function at 0x4430b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
dec edx
push edi
mov edi, ecx
cmp edx, 0xfe
ja case.0x4430d7.2
movzx eax, byte [edx + 0x4431c4]
jmp dword [eax*4 + 0x4431a4]
mov esi, 0x2b
jmp 0x44310d
mov esi, 0x23
jmp 0x44310d
mov esi, 0x1a
jmp 0x44310d
mov esi, 0x1c
jmp 0x44310d
mov esi, 0x2a
jmp 0x44310d
mov esi, 0x26
jmp 0x44310d
mov esi, 0x2c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x44314b
cmp esi, 0x2c
jne 0x443190
lea edx, [esi - 0x2b]
mov ecx, edi
call fcn.004430b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.00442aa0
mov esi, eax
add esp, 4
test esi, esi
je 0x443190
push 0xffffffffffffffff
push esi
push 0x104
push edi
call fcn.0058e951
xor ecx, ecx
test eax, eax
push esi
cmovne edi, ecx
call fcn.0058d115
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00562e44
mov esp, ebp
pop ebp
ret

Function at 0x443440
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
push esi
push edi
test ebx, ebx
je 0x4434d3
test edx, edx
je 0x4434d3
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x443470
sub ecx, esi
je 0x4434d3
push edx
call fcn.00442a40
mov edi, eax
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.0058f81d
push edi
mov esi, eax
call fcn.0058d115
add esp, 0x10
test esi, esi
jne 0x4434d3
mov eax, dword [ebp - 0x24]
inc eax
push 1
push eax
call fcn.0058d1e5
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x4434d3
push 0x63eec8
push dword [ebp - 0x3c]
call fcn.00442d90
mov edi, eax
add esp, 8
test edi, edi
jne 0x4434e7
push dword [ebx]
call fcn.0058d115
add esp, 4
mov dword [ebx], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x24]
push 1
push dword [ebx]
call fcn.0058a6c2
push edi
mov esi, eax
call fcn.00581e19
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00562e44
mov esp, ebp
pop ebp
ret
Function at 0x443970
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d82a0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x64], edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.0044be30
test al, al
je 0x443b6e
xor ecx, ecx
mov dword [ebp - 0x48], 7
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x34]
mov word [ebp - 0x5c], cx
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
call fcn.00433990
push str..trace
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00433230
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.0044c0b0
mov byte [ebp - 4], 1
mov bl, al
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x443a28
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.00433df0
test bl, bl
je 0x443b45
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
call fcn.0044bec0
test al, al
je 0x443b45
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x443a66
mov dword [esi + 0x64], 0xa
jmp 0x443b45
push str..debug
lea ecx, [ebp - 0x44]
call fcn.00433230
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.0044c0b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.004331f0
test bl, bl
je 0x443aa4
lea ecx, [ebp - 0x2c]
call fcn.0044be10
test al, al
jne 0x443b39
lea ecx, [ebp - 0x2c]
call fcn.0044c160
test al, al
je 0x443b45
push str.asu.trace
lea ecx, [ebp - 0x44]
call fcn.00433230
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.0044bec0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.004331f0
test bl, bl
je 0x443b45
lea ecx, [ebp - 0x2c]
call fcn.0044be10
test al, al
je 0x443af7
mov dword [esi + 0x64], 0xa
jmp 0x443b45
lea ecx, [ebp - 0x2c]
call fcn.0044c160
test al, al
je 0x443b45
push str.asu.debug
lea ecx, [ebp - 0x44]
call fcn.00433230
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.0044bec0
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.004331f0
test bl, bl
je 0x443b45
lea ecx, [ebp - 0x2c]
call fcn.0044be10
test al, al
je 0x443b45
cmp edi, 0x14
jle 0x443b45
mov dword [esi + 0x64], 0x14
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x443b5a
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00433df0
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x443b83
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00433df0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret 4
Function at 0x4440c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add ecx, 0x4c
mov word [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ecx + 0x14], 8
jb 0x4440de
mov ecx, dword [ecx]
push 0x641f5c
push ecx
lea eax, [ebp - 8]
push eax
call fcn.0058620b
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x444137
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.0058a6c2
push dword [ebp - 8]
call fcn.00581e19
mov cl, byte [ebp - 4]
add esp, 0x14
mov al, byte [ebp - 3]
cmp cl, 0xff
jne 0x44411f
cmp al, 0xfe
je 0x444128
cmp al, 0xff
jne 0x444131
cmp cl, 0xfe
jne 0x444131
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x444140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x444178
call fcn.004440c0
test al, al
jne 0x444178
mov eax, dword [ebx]
test eax, eax
je 0x444171
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.004450d0
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x444185
mov eax, dword [esi]
jmp 0x444187
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x44421f
cmp dword [esi + 0x14], 8
jb 0x4441af
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4441da
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
lea ecx, [ebp - 4]
push 0
push ecx
jne 0x444208
push 2
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0xfeff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
lea ecx, [ebp + 8]
mov word [ebp + 8], 0xbbef
push ecx
push eax
mov byte [ebp + 0xa], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x444230
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8316
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x66c214]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4442f4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00433230
xor bl, bl
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
push 0
cmovae eax, dword [ebp - 0x260]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x4442c9
cmp eax, 0xb7
je 0x4442c9
cmp eax, 0x50
jne 0x4442cb
mov bl, 1
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x4442e9
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00433df0
test bl, bl
jne 0x4442f4
xor al, al
jmp 0x444412
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x44431e
xor ecx, ecx
jmp 0x444336
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x444327
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00433520
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [esi], ax
jne 0x444376
xor ecx, ecx
jmp 0x44438f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x444380
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x248]
call fcn.00433520
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.0044bec0
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x234]
cmp ecx, 8
jb 0x4443d5
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.00433df0
test bl, bl
je 0x4443f2
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x230]
cmp ecx, eax
je 0x4443f0
push 0xffffffffffffffff
push 0
push eax
call fcn.00433990
mov bl, 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x444410
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00433df0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00562e44
mov esp, ebp
pop ebp
ret 4
Function at 0x444620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x444630
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x641f78
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x444690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4446a0
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
push 0x63f3e4
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4