joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435090
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0042f840
mov ebx, eax
test ebx, ebx
jne 0x4350c3
mov ecx, dword [ebp + 8]
push esi
push eax
push str.Parameter_1_invalid.
call fcn.0042d870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x4350cf
jmp dword [eax*4 + 0x4352c8]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x4350e9
push eax
call fcn.00451bf0
add esp, 4
jmp 0x4350ef
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4a84e4]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00451bf0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x435167
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x435167
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4a84e4]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push ecx
call fcn.00472eb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx edx, byte [edi]
push edx
call fcn.00485785
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x4351a2.67
movzx eax, byte [eax + 0x4352f8]
jmp dword [eax*4 + 0x4352dc]
mov esi, 0x40
jmp 0x4351d1
mov esi, 0x4000
jmp 0x4351d1
mov esi, 0x20
jmp 0x4351d1
mov esi, 0x8000
jmp 0x4351d1
mov esi, 0x80
jmp 0x4351d1
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x4351e4
push eax
call fcn.00451bf0
add esp, 4
jmp 0x4351ea
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x435167
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x435167
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x43513b
mov edx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push edx
call fcn.00472eb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [edi], 0
je 0x435263
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.00412500
fmul qword [0x49e828]
call fcn.00491950
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x435270
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00451bf0
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x43528d
test esi, esi
jne 0x43514a
jmp 0x435291
test esi, esi
je case.0x4351a2.67
cmp byte [esp + 0x13], 0
jne 0x4352af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x43514a
push 1
push 0x64
call fcn.00401280
add esp, 8
jmp 0x435270
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435b20
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a7c78]
push eax
mov eax, dword [esp + 0x18]
call fcn.00441870
mov ebp, eax
test ebp, ebp
je 0x435b46
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x435b4b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.00472eb0
cmp eax, 1
je 0x435b69
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x435c72
cmp byte [edi + 0x17], 0
jne 0x435b7c
mov esi, dword [edi + 0xc]
jmp 0x435b7e
mov esi, edi
test byte [esi + 0x15], 8
je 0x435b8b
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435ba4
test byte [esi + 0x15], 4
je 0x435b9f
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x435bb4
cmp al, 2
jne 0x435baf
call fcn.00401000
jmp 0x435bb4
mov eax, 0x4a95ee
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x435bca
mov esi, dword [edi + 0xc]
jmp 0x435bcc
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435be4
test byte [esi + 0x15], 8
je 0x435bdf
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435be9
mov eax, 0x4aa484
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x435bf6
mov esi, dword [edi + 0xc]
jmp 0x435bf8
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435c10
test byte [esi + 0x15], 8
je 0x435c0b
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435c15
mov eax, 0x4aa484
cmp dword [eax], 0
jne 0x435ce8
cmp byte [edi + 0x17], 0
jne 0x435c29
mov esi, dword [edi + 0xc]
jmp 0x435c2b
mov esi, edi
test byte [esi + 0x15], 8
je 0x435c38
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435c57
test byte [esi + 0x15], 4
je 0x435c4c
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x435ce8
cmp al, 2
jne 0x435c68
call fcn.00401000
mov byte [eax], 0
jmp 0x435ce8
mov eax, 0x4a95ee
mov byte [eax], 0
jmp 0x435ce8
cmp byte [edi + 0x17], 0
jne 0x435c7d
mov esi, dword [edi + 0xc]
jmp 0x435c7f
mov esi, edi
test byte [esi + 0x15], 8
je 0x435c8c
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435ca5
test byte [esi + 0x15], 4
je 0x435ca0
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x435cb5
cmp al, 2
jne 0x435cb0
call fcn.00401000
jmp 0x435cb5
mov eax, 0x4a95ee
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435cc3
mov esi, dword [edi + 0xc]
jmp 0x435cc5
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435cdd
test byte [esi + 0x15], 8
je 0x435cd8
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435ce2
mov eax, 0x4aa484
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435cf1
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x435d16
cmp dword [0x4a9d40], 0
je 0x435d16
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4a9d34
jmp fcn.00403f10
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x436b40
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.0048f760
push ebp
mov ebp, dword [0x4a7c78]
push esi
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 0x7fff
jb 0x436c6a
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push ebp
call fcn.00472eb0
test eax, eax
jne 0x436b90
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
cmp byte [ebp + 0x17], 0
jne 0x436b9b
mov esi, dword [ebp + 0xc]
jmp 0x436b9d
mov esi, ebp
test byte [esi + 0x15], 8
je 0x436baa
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436bc3
test byte [esi + 0x15], 4
je 0x436bbe
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x436bd3
cmp al, 2
jne 0x436bce
call fcn.00401000
jmp 0x436bd3
mov eax, 0x4a95ee
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x436c25
cmp byte [ebp + 0x17], al
jne 0x436bea
mov esi, dword [ebp + 0xc]
jmp 0x436bec
mov esi, ebp
test byte [esi + 0x15], 8
je 0x436bf9
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436c12
test byte [esi + 0x15], 4
je 0x436c0d
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x436c22
cmp al, 2
jne 0x436c1d
call fcn.00401000
jmp 0x436c22
mov eax, 0x4a95ee
mov byte [eax], 0
cmp byte [ebp + 0x17], 0
jne 0x436c30
mov eax, dword [ebp + 0xc]
jmp 0x436c32
mov eax, ebp
cmp byte [eax + 0x17], 2
jne 0x436c57
cmp dword [0x4a9d40], 0
je 0x436c57
push 1
mov ecx, 0x4a9d34
call fcn.00403f10
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
and byte [eax + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x436c77
mov eax, 0x496816
push 1
push 0
push edi
push eax
push ebp
call fcn.00472eb0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
Function at 0x4394a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
je 0x4394d8
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x439553
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push str.InstallDir
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x4394d0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4394d0
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], bl
jne 0x439537
cmp eax, ebx
je 0x439553
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], bl
jne 0x439531
dec eax
jne 0x439528
mov dword [esp + 0x10], eax
jmp 0x43954f
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x43954b
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x439553
mov byte [esp + eax + 0x18], bl
cmp eax, ebx
jne 0x439561
cmp edi, ebx
jne 0x439561
mov edi, 0x100
jmp 0x4394b4
mov esi, dword [esp + 0x120]
cmp esi, ebx
je 0x43957e
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x439574
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x43cab0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4a7c78]
push esi
push edi
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [edi]
test cl, cl
je 0x43cb9e
cmp byte [edi + 1], 0
jne 0x43cb1a
mov byte [esp + 0x14], cl
cmp cl, 0xa
jne 0x43caea
mov al, 0xd
jmp 0x43cb8f
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
jne 0x43cb0e
cmp cl, 0xff
jne 0x43cb0e
xor al, al
jmp 0x43cb8f
and al, 0x38
neg al
sbb al, al
not al
and al, cl
jmp 0x43cb8f
movzx esi, cl
test esi, 0xffffff80
jne 0x43cb37
push 2
push esi
call fcn.0048447e
add esp, 8
test eax, eax
je 0x43cb37
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x43cb5b
mov al, byte [edi + 1]
call fcn.00408ec0
cmp al, 0x4b
jne 0x43cb5b
push 0x10
lea eax, [edi + 2]
push 0
push eax
call fcn.004848c4
add esp, 0xc
jmp 0x43cb8f
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esi*8 + 0x4a5160]
push edi
push eax
call fcn.00482f41
add esp, 8
test eax, eax
je 0x43cbd1
inc esi
cmp esi, 0x6d
jl 0x43cb60
mov eax, edi
call fcn.00411690
movzx ecx, ax
test cx, cx
je 0x43cb9e
call fcn.00411df0
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
jne 0x43cc1b
push 0
lea ebx, [esp + 0x18]
mov eax, edi
call fcn.0044cf50
mov edi, eax
add esp, 4
test edi, edi
jne 0x43cbde
push 1
push eax
push 0xffffffffffffffff
push 0x496816
push ebp
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov cl, byte [esi*8 + 0x4a5164]
mov byte [esp + 0x13], cl
jmp 0x43cb93
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
call fcn.0044d1f0
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.00472800
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov ecx, dword [esp + 0x12c]
movzx ebx, byte [ecx]
test ebx, 0xffffff80
jne 0x43cc3f
push 2
push ebx
call fcn.0048447e
add esp, 8
test eax, eax
je 0x43cc3f
and bl, 0xdf
cmp bl, 0x50
je 0x43cc52
xor eax, eax
cmp bl, 0x54
setne al
dec eax
and eax, 2
jmp 0x43cc57
mov eax, 1
mov bl, byte [esp + 0x13]
push eax
call fcn.0044d140
add esp, 4
test al, al
mov eax, 0x49ba28
jne 0x43cc72
mov eax, 0x49ba2c
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
Function at 0x43cc90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
mov esi, ecx
mov ecx, dword [0x4a7c78]
push edi
call fcn.00412540
test esi, esi
je 0x43ce06
cmp byte [esi], 0
je 0x43ce06
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.00485ee0
lea eax, [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x134], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cce0
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
je 0x43cd09
lea ecx, [eax + 1]
cmp ecx, 0x105
jae 0x43ce06
mov byte [esp + eax + 0x30], 0x5c
mov byte [esp + eax + 0x31], 0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4aae70], 1
jne 0x43cd3f
or dword [0x4aae70], 1
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4aae6c], eax
jmp 0x43cd44
mov eax, dword [0x4aae6c]
test eax, eax
je 0x43cd92
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43ce06
cmp byte [ebp + 0xc], 0
je 0x43cd7f
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43cdd4
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43cdd4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43ce06
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x14]
jne 0x43cdc3
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push ecx
call fcn.00472eb0
mov eax, dword [0x4a7c78]
push 0x18
push edi
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x4a4440]
cmp byte [edx + 0xe4], 0
jne 0x43ce33
mov eax, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x497ee0
push eax
call fcn.00472eb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x496816
push 0
push 0x497ee0
call fcn.0042d5b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43ebf0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call ebx
test eax, eax
jne 0x43ec1d
cmp byte [0x4aa330], al
je 0x43ecc4
call fcn.00408fd0
pop ebx
add esp, 0x10c
ret
cmp byte [0x4aa330], 0
push ebp
push esi
mov esi, 0x4a84e8
jne 0x43ec31
lea esi, [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0x104
call ebp
test eax, eax
je 0x43ec8c
cmp byte [edi], 0
je 0x43eca2
cmp byte [edi + 1], 0x3a
jne 0x43eca2
cmp byte [edi + 2], 0
jne 0x43eca2
push esi
push edi
call fcn.00482f41
add esp, 8
test eax, eax
je 0x43eca2
push edi
lea eax, [esp + 0x10]
push 0x49bc98
push eax
call fcn.00483478
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call ebx
test eax, eax
je 0x43eca2
push esi
push 0x104
call ebp
test eax, eax
jne 0x43eca2
push 0x103
push edi
push esi
call fcn.00485ee0
mov byte [esi + 0x103], 0
add esp, 0xc
cmp byte [0x4aa330], 0
pop esi
pop ebp
je 0x43ecc4
mov edx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push edx
call fcn.00472eb0
pop ebx
add esp, 0x10c
ret
Function at 0x43f2c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
mov ebp, ecx
test edi, edi
je 0x43f442
cmp byte [edi], 0
je 0x43f442
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43f31b
mov ecx, dword [0x4a4440]
shr eax, 4
not al
and al, 1
movzx edx, al
push edx
push ebp
mov dword [ecx + 0x30], 0xb7
call fcn.0042d6a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0x5c
push edi
call fcn.00484e4e
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x43f409
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f335
sub eax, edx
cmp eax, 0x104
jb 0x43f383
mov eax, dword [0x4a4440]
mov dword [eax + 0x30], 0x6f
cmp byte [eax + 0xe4], cl
jne 0x43f37c
mov eax, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x497ee0
push eax
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov ecx, ebp
jmp 0x43f45b
mov esi, ebx
sub esi, edi
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.00485ee0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
mov byte [esp + esi + 0x1c], 0
call fcn.0043f2c0
cmp byte [ebx + 1], 0
je 0x43f3f7
mov esi, dword [0x4a84e4]
cmp byte [esi + 0x17], 0
jne 0x43f3bc
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x43f3c9
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43f3e2
test byte [esi + 0x15], 4
je 0x43f3dd
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x43f3f2
cmp al, 2
jne 0x43f3ed
call fcn.00401000
jmp 0x43f3f2
mov eax, 0x4a95ee
cmp byte [eax], 0x31
jne 0x43f409
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
sete al
mov byte [esp + 0x14], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4a4440]
push edx
push ebp
mov dword [ecx + 0x30], eax
call fcn.0042d6a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, dword [0x4a4440]
cmp byte [eax + 0xe4], 0
mov dword [eax + 0x30], 0x57
je 0x43f359
push 0x496816
push 0
push 0x497ee0
call fcn.0042d5b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x440140
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
test edi, edi
je 0x4401c5
cmp byte [edi + 0x17], 0
jne 0x44015a
mov esi, dword [edi + 0xc]
jmp 0x44015c
mov esi, edi
mov bl, 8
test byte [esi + 0x15], bl
je 0x44016a
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x440183
test byte [esi + 0x15], 4
je 0x44017e
mov eax, esi
call fcn.0042e090
mov eax, dword [esi + 8]
jmp 0x440193
cmp al, 2
jne 0x44018e
call fcn.00401000
jmp 0x440193
mov eax, 0x4a95ee
cmp byte [edi + 0x17], 0
mov ebp, eax
jne 0x4401a0
mov esi, dword [edi + 0xc]
jmp 0x4401a2
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x4401bc
test byte [esi + 0x15], bl
je 0x4401b4
mov eax, esi
call fcn.00401150
mov ebx, dword [esi + 0xc]
add esi, 0xc
jmp 0x4401f8
mov esi, 0x4aa484
mov ebx, dword [esi]
jmp 0x4401f8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
call fcn.00472940
add esp, 0xc
test eax, eax
jne 0x4401f0
mov edx, dword [0x4a4440]
mov dword [edx + 0x30], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
xor edi, edi
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x440239
mov dword [esp + 0x20], edi
test ebp, ebp
je 0x44022e
push edi
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
cmp dword [esp + 0x20], ebx
sete dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4a4440]
mov dword [ecx + 0x30], eax
cmp esi, 0xffffffff
je 0x440254
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x24], 0
jne 0x440264
push ebp
call fcn.00482f58
add esp, 4
mov ecx, dword [esp + 0x1c]
test edi, edi
sete dl
movzx eax, dl
push eax
push ecx
call fcn.0042d6a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x440520
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
mov ebx, edx
call fcn.0040c880
test al, al
je 0x440548
push 0x10
push 0
push edi
call fcn.004848c4
add esp, 0xc
jmp 0x440551
push edi
call fcn.004844c6
add esp, 4
cmp eax, 1
je 0x4405b6
call fcn.00451870
test al, al
je 0x4405b6
mov eax, dword [0x4a4440]
cmp byte [eax + 0xe4], 0
jne 0x440591
mov ecx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x497ee0
push ecx
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov ecx, dword [esp + 0x124]
push 0x496816
push 0
push 0x497ee0
call fcn.0042d5b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x440604
mov edx, dword [0x4a4440]
cmp byte [edx + 0xe4], 0
jne 0x440591
push 1
push 0
push eax
mov eax, dword [0x4a84e4]
push 0x497ee0
push eax
call fcn.00472eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440610
sub eax, edx
cmp eax, 0x104
jb 0x440625
mov eax, 0x103
inc eax
push eax
lea ecx, [esp + 0x1c]
push ebx
push ecx
call fcn.0048b890
lea edx, [esp + 0x24]
add esp, 0xc
push edx
call fcn.0048589e
add esp, 4
push 0xa
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x440691
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440691
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x440691
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x440693
xor bl, bl
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
test bl, bl
sete dl
movzx eax, dl
push eax
push ecx
call fcn.0042d6a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x4406c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x4a7c78]
sub esp, 0x80
push esi
mov esi, eax
call fcn.00412540
test esi, esi
je 0x440775
cmp byte [esi], 0
je 0x440775
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44072c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4a4440]
cmp byte [ecx + 0xe4], 0
mov dword [ecx + 0x30], eax
jne 0x4407a9
mov eax, dword [0x4a84e4]
push 1
push 0
push esi
push 0x497ee0
push eax
call fcn.00472eb0
pop esi
add esp, 0x80
ret
mov edx, dword [0x4a84e4]
mov ecx, dword [0x4a4440]
push 1
push 0
push 0xffffffffffffffff
push 0x496860
push edx
mov dword [ecx + 0x30], 0
call fcn.00472eb0
mov edx, esi
lea eax, [esp + 4]
call fcn.00471190
push 1
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [0x4a7c78]
push eax
call fcn.00472eb0
pop esi
add esp, 0x80
ret
mov eax, dword [0x4a4440]
cmp byte [eax + 0xe4], 0
mov dword [eax + 0x30], 0x57
jne 0x4407a9
mov ecx, dword [0x4a84e4]
push 1
push 0
push 0xffffffffffffffff
push 0x497ee0
push ecx
call fcn.00472eb0
pop esi
add esp, 0x80
ret
push 0x496816
push 0
push 0x497ee0
mov ecx, edi
call fcn.0042d5b0
pop esi
add esp, 0x80
ret