joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401408
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40141a
mov eax, dword [0x51808b]
shl eax, 2
mov dword [0x51808f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00509ea4
pop edx
call fcn.00509228
call fcn.00509ea8
push 0
call fcn.0050ae70
pop ecx
push 0x518034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x518093], eax
push 0
jmp fcn.00514050

Function at 0x427eca
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0
cmp dword [ebp + 0xc], 0
je 0x427ee0
mov eax, 2
jmp 0x427ee2
xor eax, eax
push eax
push 0
xor edx, edx
mov dl, bl
push edx
call sub.USER32.DLL_MapVirtualKeyA
push eax
push ebx
call sub.USER32.DLL_keybd_event
pop ebx
pop ebp
ret

Function at 0x42d42c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 4
call fcn.0048abfc
add esp, 8
push eax
call fcn.0046c1e4
pop ecx
sub eax, 2
je 0x42d492
sub eax, 6
je 0x42d492
sub eax, 0x3f8
je 0x42d455
pop ebp
ret
push 5
call fcn.0048b5fc
pop ecx
push eax
push 4
call fcn.0048ad60
pop ecx
push eax
push 3
call fcn.0048b5fc
pop ecx
push eax
push 0
push 2
call fcn.0048ad60
pop ecx
push eax
push 1
call fcn.0048b5fc
pop ecx
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
push eax
call fcn.0048bb28
pop ecx
pop ebp
ret
push 5
call fcn.0048b5fc
pop ecx
push eax
push 4
call fcn.0048b5fc
pop ecx
push eax
push 3
call fcn.0048b5fc
pop ecx
push eax
push 0
push 2
call fcn.0048ad60
pop ecx
push eax
push 1
call fcn.0048b5fc
pop ecx
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
push eax
call fcn.0048bb28
pop ecx
pop ebp
ret

Function at 0x42f512
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.USER32.DLL_GetDC
mov ebx, eax
push ebx
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call sub.GDI32.DLL_CreateCompatibleBitmap
mov edi, eax
push edi
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 4], eax
push 0xcc0020
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push 0
push esi
call sub.GDI32.DLL_BitBlt
push dword [ebp - 4]
push esi
call sub.GDI32.DLL_SelectObject
push ebx
push dword [ebp + 8]
call sub.USER32.DLL_ReleaseDC
push esi
call sub.GDI32.DLL_DeleteDC
push 0x640a91
push edi
call fcn.00405e49
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432763
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push ebx
call sub.USER32.DLL_BeginPaint
mov esi, eax
push ebx
call sub.USER32.DLL_GetWindowTextLengthA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.0048a490
pop ecx
mov edi, eax
push 0
push 0
push 0x31
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_SendMessageA
push eax
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 8], eax
lea eax, [ebp - 0x58]
push eax
push ebx
call sub.USER32.DLL_GetClientRect
push 1
push esi
call sub.GDI32.DLL_SetBkMode
mov edx, dword [ebp - 4]
inc edx
push edx
push edi
push ebx
call sub.USER32.DLL_GetWindowTextA
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0xffffffffffffffff
push edi
push esi
call sub.USER32.DLL_DrawTextA
push edi
call fcn.0048a558
pop ecx
push dword [ebp - 8]
push esi
call sub.GDI32.DLL_SelectObject
lea eax, [ebp - 0x48]
push eax
push ebx
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432803
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
push ebx
call sub.USER32.DLL_BeginPaint
mov esi, eax
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
call fcn.00431fa8
lea eax, [ebp - 0x70]
push eax
push ebx
call sub.USER32.DLL_GetClientRect
push 0x640e10
push ebx
call dword [0x640cd0]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.USER32.DLL_ClientToScreen
lea edx, [ebp - 0x10]
push edx
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_ScreenToClient
push 0xcc0020
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x6c]
push ecx
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_BitBlt
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x68], 0x10
push 0
push 0
push 0xf0
push ebx
call sub.USER32.DLL_SendMessageA
dec eax
jne 0x4328c9
push 0
lea ecx, [ebp - 0x70]
push ecx
push 5
push 2
push esi
push dword [ebp - 4]
call dword [0x640cd4]
jmp 0x4328dd
push 0
lea eax, [ebp - 0x70]
push eax
push 1
push 2
push esi
push dword [ebp - 4]
call dword [0x640cd4]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], 0xf
push ebx
call sub.USER32.DLL_GetWindowTextLengthA
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
call fcn.0048a490
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
push edi
push ebx
call sub.USER32.DLL_GetWindowTextA
push 0
push 0
push 0xffffffffffffffff
push edi
push 1
push 1
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
add edx, edx
push edx
call fcn.0048a490
pop ecx
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0x31
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_SendMessageA
push eax
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push edi
push 1
push 1
call sub.KERNEL32.DLL_MultiByteToWideChar
add dword [ebp - 0x70], 2
add dword [ebp - 0x6c], 5
add dword [ebp - 0x64], 5
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x1c]
push 0
push 2
push esi
push dword [ebp - 4]
call dword [0x640ce0]
push dword [ebp - 0x20]
push esi
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0x1c]
call fcn.0048a558
pop ecx
push edi
call fcn.0048a558
pop ecx
push dword [ebp - 4]
call dword [0x640cdc]
push dword [ebp - 8]
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_ReleaseDC
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438888
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_OutputDebugStringA
test ebx, ebx
jne 0x4388a6
push esi
call fcn.0050a120
pop ecx
mov ebx, eax
cmp dword [0x6418e0], 0
je 0x4388b4
call fcn.0043eed8
test ebx, ebx
jbe 0x4388c2
push ebx
push esi
call fcn.0043f6d8
add esp, 8
cmp dword [0x6418e0], 0
je 0x4388d0
call fcn.0043eef8
pop esi
pop ebx
pop ebp
ret

Function at 0x43afa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
xor edx, edx
lea ecx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push ecx
push edi
call fcn.0043d79c
add esp, 8
mov edi, eax
push edi
call fcn.0050a120
pop ecx
mov ebx, eax
lea esi, [edi + ebx - 1]
jmp 0x43afd6
dec ebx
dec esi
test ebx, ebx
je 0x43afef
movsx eax, byte [esi]
push eax
push 0x6419fc
call fcn.0050a044
add esp, 8
test eax, eax
jne 0x43afd4
test ebx, ebx
je 0x43b012
cmp ebx, 0x107
ja 0x43b012
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x43b00a
xor edx, edx
jmp 0x43b00f
mov edx, eax
and edx, 0x10
mov dword [ebp - 4], edx
push 0
call fcn.0043db00
cmp dword [ebp - 8], 0
pop ecx
je 0x43b02a
mov eax, dword [ebp - 8]
push eax
call fcn.0048a558
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43c2bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
je 0x43c2ca
xor eax, eax
jmp 0x43c2cf
mov eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.0043db18
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x43c80c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.00458428
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
test ebx, ebx
je 0x43c84c
mov ax, word [ebp - 4]
jmp 0x43c84e
xor eax, eax
mov ebx, eax
cmp bx, 0xffff
jne 0x43c859
xor ebx, ebx
call fcn.00458424
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x43c864
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.00458428
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x43c89e
movzx ecx, si
lea edx, [ebp - 4]
push 0
push edx
push ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, eax
jmp 0x43c8b2
xor edx, edx
mov dword [ebp - 4], edx
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
test ebx, ebx
je 0x43c8c7
mov cx, word [ebp - 4]
jmp 0x43c8c9
xor ecx, ecx
mov ebx, ecx
call fcn.00458424
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x43c8d8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00458428
push 0
lea eax, [ebp - 4]
push 0
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x43c918
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00458428
test esi, esi
je 0x43c957
push 0
push 0
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.0043db18
add esp, 8
jmp 0x43c96f
push 0
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43c97c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c5748
test eax, eax
je 0x43c9e9
call fcn.00458428
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00509f60
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0xc], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x18]
push edx
push ecx
push edi
push esi
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
jmp 0x43ca23
call fcn.00458428
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.0043cea8
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x43ca19
cmp eax, dword [ebp + 0x14]
jne 0x43ca19
push edi
push esi
push ebx
call fcn.0043c8d8
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x43ca1e
xor edx, edx
mov dword [ebp - 4], edx
call fcn.00458424
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ca30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c5748
test eax, eax
je 0x43ca9d
call fcn.00458428
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00509f60
mov eax, dword [ebp + 0x14]
add esp, 0xc
and eax, 0xffffffff
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
mov dword [ebp - 0xc], eax
sar edx, 0x1f
push 0
lea edx, [ebp - 0x18]
push edx
push ecx
push edi
push esi
push ebx
call fcn.0043bce4
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
jmp 0x43cad7
call fcn.00458428
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.0043cea8
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x43cacd
cmp eax, dword [ebp + 0x14]
jne 0x43cacd
push edi
push esi
push ebx
call fcn.0043c918
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x43cad2
xor edx, edx
mov dword [ebp - 4], edx
call fcn.00458424
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43cfcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0043d79c
add esp, 8
mov ebx, eax
call fcn.00458428
push ebx
call sub.KERNEL32.DLL_DeleteFileA
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
call fcn.00458424
cmp dword [ebp - 4], 0
je 0x43d010
mov edx, dword [ebp - 4]
push edx
call fcn.0048a558
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x43d018
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0043d79c
add esp, 8
mov ebx, eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.0043d79c
add esp, 8
mov esi, eax
call fcn.00458428
push esi
push ebx
call sub.KERNEL32.DLL_MoveFileA
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
call fcn.00458424
cmp dword [ebp - 4], 0
je 0x43d072
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048a558
pop ecx
cmp dword [ebp - 8], 0
je 0x43d082
mov eax, dword [ebp - 8]
push eax
call fcn.0048a558
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43d0d8
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0043d79c
add esp, 8
mov ebx, eax
call fcn.00458428
push ebx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
call fcn.00458424
cmp dword [ebp - 4], 0
je 0x43d11c
mov edx, dword [ebp - 4]
push edx
call fcn.0048a558
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x43d194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov word [ebp - 2], di
mov byte [ebx], 0
test di, di
je 0x43d1d1
call fcn.0043d314
and eax, 0xff
inc eax
mov word [ebp - 2], ax
cmp di, word [ebp - 2]
je 0x43d1d1
mov edx, edi
add dl, 0xff
push edx
call fcn.0043d290
pop ecx
call fcn.00458428
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
call fcn.0043dad4
mov word [ebp - 4], ax
cmp di, word [ebp - 2]
je 0x43d214
mov cl, byte [ebp - 2]
add cl, 0xff
push ecx
call fcn.0043d290
mov ax, word [ebp - 4]
pop ecx
push eax
call fcn.0043db00
pop ecx
mov byte [ebx + esi - 1], 0
cmp word [ebp - 4], 0
jne 0x43d286
cmp byte [ebx], 0
je 0x43d286
mov edi, ebx
push ebx
call fcn.0050a120
pop ecx
mov esi, eax
cmp byte [edi + 1], 0x3a
jne 0x43d23c
add edi, 2
sub esi, 2
movsx eax, byte [edi]
push eax
push 0x641a5e
call fcn.0050a044
add esp, 8
test eax, eax
je 0x43d253
inc edi
dec esi
test esi, esi
je 0x43d26f
movsx edx, byte [edi + esi - 1]
push edx
push 0x641a5e
call fcn.0050a044
add esp, 8
test eax, eax
je 0x43d26f
dec esi
test esi, esi
je 0x43d282
cmp edi, ebx
je 0x43d282
push esi
push edi
push ebx
call fcn.00509f14
add esp, 0xc
mov byte [ebx + esi], 0
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43d704
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.0043db18
add esp, 8
call fcn.00458424
call fcn.0043dad4
test ax, ax
je 0x43d744
call fcn.0043dad4
jmp 0x43d796
mov eax, ebx
cmp byte [eax + 1], 0x3a
jne 0x43d74f
add eax, 2
cmp eax, ebx
je 0x43d75e
push esi
push eax
push ebx
call fcn.00509f14
add esp, 0xc
push ebx
call fcn.0050a120
pop ecx
mov esi, eax
movsx eax, byte [ebx + esi - 1]
push eax
push 0x641a5e
call fcn.0050a044
add esp, 8
test eax, eax
je 0x43d784
mov byte [ebx + esi], 0
jmp 0x43d794
push 0
push 0x641a62
push ebx
call fcn.004c2898
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43e670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0x63
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x43e6a8
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x43e6a8
push 0x107
mov edx, dword [ebp + 8]
push edx
push ebx
call fcn.004c329c
add esp, 0xc
jmp 0x43e6be
push ebx
push 0x107
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x43e6be
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
cmp byte [ebx], 0
je 0x43e6da
push ebx
call fcn.0050a120
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x43e6da
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
cmp dword [ebp + 0xc], 0
je 0x43e6f2
push 0x107
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.004c32d8
add esp, 0xc
push ebx
call fcn.0050a120
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x101
jle 0x43e70d
or eax, 0xffffffff
jmp 0x43e7b6
call fcn.0044569c
fstp qword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
lea edi, [ebx + ecx]
fld qword [ebp - 0x14]
fmul dword [0x43e7c0]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00510a58
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00510ef0
fstp qword [ebp - 0x14]
add esp, 0xc
cmp esi, 9
mov ecx, esi
jle 0x43e756
mov al, 0x57
jmp 0x43e758
mov al, 0x30
add cl, al
mov byte [edi], cl
inc dword [ebp - 8]
inc edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 6
jl 0x43e720
mov edx, dword [ebp - 8]
mov byte [ebx + edx], 0
cmp dword [ebp + 0x18], 0
je 0x43e788
push 0x107
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
call fcn.004c32d8
add esp, 0xc
push 0
push ebx
call fcn.0043d79c
add esp, 8
push 0x410
mov eax, dword [ebp + 0x10]
push eax
push ebx
call fcn.0043c410
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43e7b6
dec dword [ebp - 4]
jne 0x43e683
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e7c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43e7f4
cmp byte [eax], 0
je 0x43e7f4
push 0x107
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004c329c
add esp, 0xc
jmp 0x43e819
lea edx, [ebp - 0x108]
push edx
push 0x108
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x43e819
push 0
push 0
call fcn.0043db18
add esp, 8
xor eax, eax
jmp 0x43e848
mov byte [ebp - 1], 0
mov edx, dword [ebp + 8]
push edx
push 0
test ebx, ebx
jne 0x43e82c
mov ebx, 0x641af8
push ebx
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov ebx, eax
push 0
push ebx
call fcn.0043db18
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e9a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
mov ebx, dword [ebp + 8]
mov si, 0xffff
mov byte [ebx], 0
lea eax, [ebp - 0x108]
push eax
push 0x108
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x43e9e5
mov byte [ebp - 1], 0
lea eax, [ebp - 0x108]
push 0x107
push eax
push ebx
xor esi, esi
call fcn.004c329c
add esp, 0xc
test si, si
jne 0x43ea0f
cmp byte [ebx], 0
je 0x43ea0f
push ebx
call fcn.0050a120
cmp byte [ebx + eax - 1], 0x5c
pop ecx
je 0x43ea1a
cmp eax, 0x107
jge 0x43ea1a
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
jmp 0x43ea1a
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0x5c
mov byte [ebx + 2], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440a30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x641edc]
mov dword [ebp - 8], eax
mov eax, dword [0x641ee0]
mov dword [ebp - 4], eax
push 7
call fcn.0048a490
pop ecx
mov ebx, eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.004c28dc
add esp, 0xc
push 0
push 0x641ee8
push ebx
call fcn.004c2898
add esp, 0xc
lea edx, [ebp - 0x148]
push edx
push ebx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x440ad3
test byte [ebp - 0x148], 0x10
je 0x440abc
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.DLL_CompareFileTime
dec eax
jne 0x440abc
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x148]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x440a8e
push esi
call sub.KERNEL32.DLL_FindClose
push ebx
call fcn.0048a558
pop ecx
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov eax, edi
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret