joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437210
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [0x4c8480]
push edi
push eax
mov eax, dword [esp + 0x18]
call fcn.00442980
mov edi, eax
test edi, edi
je 0x437236
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [eax + 1]
jmp 0x43723b
mov ebp, 1
push 1
push 0
lea ecx, [ebp - 1]
push ecx
push 0
push esi
call fcn.00477510
cmp eax, 1
je 0x437259
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov ecx, esi
test edi, edi
je 0x4372eb
push ebp
push 0
push 1
call fcn.00401220
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [esi + 0x17], 0
mov ebp, eax
jne 0x437282
mov edi, dword [esi + 0xc]
jmp 0x437284
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43729c
test byte [edi + 0x15], 8
je 0x437297
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x4372a1
mov eax, 0x4ca418
lea edx, [ebp + ebp]
mov dword [eax], edx
cmp byte [esi + 0x17], 0
jne 0x4372b2
mov edi, dword [esi + 0xc]
jmp 0x4372b4
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x4372cc
test byte [edi + 0x15], 8
je 0x4372c7
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x4372d1
mov eax, 0x4ca418
test dword [eax], 0xfffffffe
jne 0x437328
push 0
push 1
mov ecx, esi
call fcn.00401220
xor ecx, ecx
mov word [eax], cx
jmp 0x437328
push 0
push 1
call fcn.00401220
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], dl
jne 0x437303
mov edi, dword [esi + 0xc]
jmp 0x437305
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43731d
test byte [edi + 0x15], 8
je 0x437318
mov eax, edi
call fcn.00401160
lea eax, [edi + 0xc]
jmp 0x437322
mov eax, 0x4ca418
mov dword [eax], 0
cmp byte [esi + 0x17], 0
jne 0x437331
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x437351
cmp dword [0x4ca25c], 0
je 0x437351
mov ecx, 0x4ca250
call fcn.004042b0
pop edi
pop esi
pop ebp
pop ecx
ret 4
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4

Function at 0x4380f0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004993f0
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
mov esi, dword [0x4c8480]
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0x7fff
jb 0x4381a4
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push esi
call fcn.00477510
test eax, eax
jne 0x438142
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
push edi
push 0
push 1
mov ecx, esi
call fcn.00401220
push eax
push ebx
call ebp
test eax, eax
jne 0x438165
push eax
push 1
mov ecx, esi
call fcn.00401220
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], 0
jne 0x43816e
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x438191
cmp dword [0x4ca25c], 0
je 0x438191
mov ecx, 0x4ca250
call fcn.004042b0
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x4381b1
mov eax, 0x4a1868
push 1
push 0
push edi
push eax
push esi
call fcn.00477510
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
Function at 0x43a490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, eax
mov eax, dword [0x4ca1ec]
push ebx
push eax
push str.__s_s
mov esi, 0x800
call fcn.00474670
mov esi, eax
lea ecx, [esi + 1]
add esp, 0xc
cmp ecx, 0x800
jg 0x43a4e7
lea edx, [edi + 2]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a4e7
mov edx, dword [esp + 0x14]
mov dword [edi + esi*2], 0x22
mov ecx, dword [0x4ca1ec]
pop edi
pop esi
mov dword [edx], ecx
mov al, 1
pop ebp
ret
push ebp
call fcn.0043aae0
add esp, 4
test eax, eax
je 0x43a537
push ebx
push ebp
push str.__s_s
mov esi, 0x800
call fcn.00474670
mov esi, eax
lea edx, [esi + 1]
add esp, 0xc
cmp edx, 0x800
jg 0x43a537
lea eax, [edi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a537
mov eax, dword [esp + 0x14]
mov dword [edi + esi*2], 0x22
pop edi
mov dword [eax], ebp
pop esi
mov al, 1
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebp
ret

Function at 0x43a540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x2214
call fcn.004993f0
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
lea ebp, [esp + 0x1224]
push ecx
mov eax, ebp
mov dword [esp + 0x18], 0x4a1868
call fcn.0043a490
add esp, 8
test al, al
jne 0x43a57e
pop edi
pop esi
pop ebp
add esp, 0x2214
ret
cmp byte [esp + 0x2224], 0
je 0x43a5ee
mov edx, dword [esp + 0x14]
push 0x4aaea8
push edx
push str.__s_s
mov esi, 0x800
lea edi, [esp + 0x22c]
call fcn.00474670
mov esi, eax
lea eax, [esi + 1]
add esp, 0xc
cmp eax, 0x800
jg 0x43a5ee
lea ecx, [esp + 0x222]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a5ee
mov edx, 0x22
xor eax, eax
lea ecx, [esp + 0x1220]
mov word [esp + esi*2 + 0x220], dx
mov word [esp + esi*2 + 0x222], ax
mov ebp, edi
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0x4c9718
mov edx, ebp
call fcn.0042f340
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebp
add esp, 0x2214
ret
Function at 0x43aae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push 0
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
je 0x43ab20
xor edx, edx
mov word [esp + 0x18], dx
xor eax, eax
jmp 0x43ab85
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.InstallDir
push edx
mov dword [esp + 0x28], 0x208
call ebp
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43abb3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43abb3
shr eax, 1
dec eax
mov dword [esp + 0x10], eax
cmp word [esp + eax*2 + 0x18], si
jne 0x43ab93
test eax, eax
je 0x43ab85
lea ecx, [esp + eax*2 + 0x16]
cmp word [ecx], 0
jne 0x43ab7d
sub ecx, 2
dec eax
jne 0x43ab71
mov dword [esp + 0x10], eax
test eax, eax
jne 0x43abbc
test edi, edi
jne 0x43abbc
mov edi, 0x100
jmp 0x43aaf8
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x43abaa
xor ecx, ecx
mov word [esp + 0x18], cx
xor eax, eax
jmp 0x43ab85
xor edx, edx
mov word [esp + eax*2 + 0x18], dx
jmp 0x43ab81
xor eax, eax
mov word [esp + 0x18], ax
jmp 0x43ab85
mov esi, dword [esp + 0x224]
test esi, esi
je 0x43abdf
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
nop
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x43abd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
Function at 0x43e2c0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [0x4c8480]
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
xor ecx, ecx
mov eax, esi
call fcn.00412b00
mov bl, al
add esp, 8
test bl, bl
jne 0x43e35f
push 0
lea ebx, [esp + 0x18]
mov eax, esi
call fcn.0044f5c0
mov edi, eax
add esp, 4
test edi, edi
jne 0x43e322
push 1
push eax
push 0xffffffffffffffff
push 0x4a1868
push ebp
call fcn.00477510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x18], eax
push 0
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
call fcn.0044f870
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.00476e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov edx, dword [esp + 0x22c]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x43e383
push 2
push esi
call fcn.0048ee7e
add esp, 8
test eax, eax
je 0x43e383
and esi, 0xffffffdf
movzx eax, si
cmp eax, 0x50
je 0x43e39b
xor ecx, ecx
cmp eax, 0x54
setne cl
lea eax, [ecx - 1]
and eax, 2
jmp 0x43e3a0
mov eax, 1
push eax
call fcn.0044f7c0
add esp, 4
test al, al
mov eax, 0x4ab378
jne 0x43e3b7
mov eax, 0x4ab37c
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.00477510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
Function at 0x43e3e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
push esi
mov esi, ecx
mov ecx, dword [0x4c8480]
push edi
call fcn.00413b70
test esi, esi
je 0x43e559
cmp word [esi], 0
je 0x43e559
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.004908f4
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x30]
mov word [esp + 0x238], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e431
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x2e], 0x5c
je 0x43e468
lea edx, [eax + 1]
cmp edx, 0x105
jae 0x43e559
mov ecx, 0x5c
xor edx, edx
mov word [esp + eax*2 + 0x30], cx
mov word [esp + eax*2 + 0x32], dx
test byte [0x4cafd8], 1
jne 0x43e496
or dword [0x4cafd8], 1
push str.GetDiskFreeSpaceExW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4cafd4], eax
jmp 0x43e49b
mov eax, dword [0x4cafd4]
test eax, eax
je 0x43e4e7
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x3c]
push edx
call eax
test eax, eax
je 0x43e559
test bl, bl
je 0x43e4d4
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e527
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43e527
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x43e559
mov eax, dword [esp + 0x14]
test bl, bl
jne 0x43e516
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov edx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a18e4
push edx
call fcn.00477510
mov eax, dword [0x4c8480]
push 0x18
push edi
push esi
call fcn.004010e0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], 1
jne 0x43e586
mov ecx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push ecx
call fcn.00477510
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
push 0x4a1868
push 0
push 0x4a420c
call fcn.0042e110
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4403f0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x218
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call ebp
test eax, eax
jne 0x44041d
cmp byte [0x4ca1f4], al
je 0x4404c9
call fcn.00409710
pop ebp
add esp, 0x218
ret
cmp byte [0x4ca1f4], 0
push ebx
push esi
mov esi, 0x4c8d40
jne 0x440431
lea esi, [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
push 0x104
call ebx
test eax, eax
je 0x44048f
cmp word [edi], 0
je 0x4404a7
cmp word [edi + 2], 0x3a
jne 0x4404a7
cmp word [edi + 4], 0
jne 0x4404a7
push esi
push edi
call fcn.0048dbf9
add esp, 8
test eax, eax
je 0x4404a7
push edi
lea ecx, [esp + 0x10]
push 0x4ab810
push ecx
call fcn.0048e003
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call ebp
test eax, eax
je 0x4404a7
push esi
push 0x104
call ebx
test eax, eax
jne 0x4404a7
push 0x103
push edi
push esi
call fcn.004908f4
add esp, 0xc
xor eax, eax
mov word [esi + 0x206], ax
cmp byte [0x4ca1f4], 0
pop esi
pop ebx
je 0x4404c9
mov ecx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a18e4
push ecx
call fcn.00477510
pop ebp
add esp, 0x218
ret
Function at 0x440b30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
push ebp
push edi
mov edi, dword [esp + 0x218]
mov ebp, ecx
test edi, edi
je 0x440c9e
cmp word [edi], 0
je 0x440c9e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x440b88
mov ecx, dword [0x4c4a14]
shr eax, 4
not al
and al, 1
movzx edx, al
push edx
push ebp
mov dword [ecx + 0x30], 0xb7
call fcn.0042e1b0
pop edi
pop ebp
add esp, 0x20c
ret 4
push ebx
push 0x5c
push edi
call fcn.0048f95a
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x440c66
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x440ba3
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x440c0f
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x6f
jne 0x440bf0
mov eax, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push eax
call fcn.00477510
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
push 0x4a1868
push 0
push 0x4a420c
mov ecx, ebp
call fcn.0042e110
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
push esi
mov esi, ebx
sub esi, edi
sar esi, 1
push esi
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.004908f4
add esp, 0xc
lea eax, [esp + 0x14]
xor edx, edx
push eax
mov ecx, ebp
mov word [esp + esi*2 + 0x18], dx
call fcn.00440b30
cmp word [ebx + 2], 0
pop esi
je 0x440c55
mov ecx, dword [0x4c8d38]
push 0
push 1
call fcn.00401220
cmp word [eax], 0x31
jne 0x440c66
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x20c
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
sete cl
mov byte [esp + 0xc], cl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x4c4a14]
mov dword [edx + 0x30], eax
mov eax, dword [esp + 0xc]
push eax
push ebp
call fcn.0042e1b0
pop ebx
pop edi
pop ebp
add esp, 0x20c
ret 4
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x440cd5
mov ecx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push ecx
call fcn.00477510
pop edi
pop ebp
add esp, 0x20c
ret 4
push 0x4a1868
push 0
push 0x4a420c
call fcn.0042e110
pop edi
pop ebp
add esp, 0x20c
ret 4
Function at 0x4418f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor edi, edi
cmp ebp, edi
je 0x441940
push edi
push 1
mov ecx, ebp
call fcn.00401220
cmp byte [ebp + 0x17], 0
mov dword [esp + 0x24], eax
jne 0x44191a
mov esi, dword [ebp + 0xc]
jmp 0x44191c
mov esi, ebp
cmp byte [esi + 0x17], 1
jne 0x441937
test byte [esi + 0x15], 8
je 0x44192f
mov eax, esi
call fcn.00401160
mov ebx, dword [esi + 0xc]
add esi, 0xc
jmp 0x44196e
mov esi, 0x4ca418
mov ebx, dword [esi]
jmp 0x44196e
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.00476f70
add esp, 0xc
test eax, eax
jne 0x44196a
mov edx, dword [0x4c4a14]
mov dword [edx + 0x30], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4419b6
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], edi
test eax, eax
je 0x4419ab
push 0
lea ecx, [esp + 0x24]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
cmp dword [esp + 0x20], ebx
sete dl
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c4a14]
mov dword [ecx + 0x30], eax
cmp esi, 0xffffffff
je 0x4419d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
jne 0x4419e2
mov edx, dword [esp + 0x24]
push edx
call fcn.0048e9d1
add esp, 4
mov edx, dword [esp + 0x1c]
test edi, edi
sete al
movzx ecx, al
push ecx
push edx
call fcn.0042e1b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x441a10
Capabilities:
Delete file

Disassembly:
sub esp, 8
push ebx
mov ebx, 0x4ab958
mov eax, esi
call fcn.004094e0
test eax, eax
jne 0x441a5f
cmp word [esi], ax
je 0x441a5f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
sete al
mov byte [esp + 8], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 8]
mov ecx, dword [0x4c4a14]
push edx
push edi
mov dword [ecx + 0x30], eax
call fcn.0042e1b0
pop ebx
add esp, 8
ret
push 0
push 0
push 0x441a00
push 0
push 1
push esi
mov ecx, edi
call fcn.00441ee0
mov ecx, dword [0x4c4a14]
xor eax, eax
cmp dword [ecx + 0x104], eax
pop ebx
sete al
add esp, 8
ret
Function at 0x441a90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
call fcn.0040dae0
test al, al
je 0x441ab6
push 0x10
push 0
push edi
call fcn.0048f2b0
add esp, 0xc
jmp 0x441abf
push edi
call fcn.0048eec6
add esp, 4
mov ebx, 1
cmp eax, ebx
je 0x441b26
call fcn.004541b0
test al, al
je 0x441b26
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], bl
jne 0x441b01
mov ecx, dword [0x4c8d38]
push ebx
push 0
push 0xffffffffffffffff
push 0x4a420c
push ecx
call fcn.00477510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
mov ecx, dword [esp + 0x228]
push 0x4a1868
push 0
push 0x4a420c
call fcn.0042e110
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x441b72
mov edx, dword [0x4c4a14]
test byte [edx + 0x100], bl
jne 0x441b01
push ebx
push 0
push eax
mov eax, dword [0x4c8d38]
push 0x4a420c
push eax
call fcn.00477510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
mov esi, dword [esp + 0x22c]
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441b80
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x441b9b
mov eax, 0x103
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
call fcn.00495f80
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.0048ff6e
add esp, 4
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x441c0a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x441c0a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x441c0a
push 0
lea edx, [esp + 0x18]
push edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x441c0c
xor bl, bl
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x228]
test bl, bl
sete al
movzx ecx, al
push ecx
push edx
call fcn.0042e1b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 8
Function at 0x441c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [0x4c8480]
sub esp, 0x100
push esi
mov esi, eax
call fcn.00413b70
test esi, esi
je 0x441cf6
cmp word [esi], 0
je 0x441cf6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x441cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c4a14]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x441d2a
mov eax, dword [0x4c8d38]
push 1
push 0
push esi
push 0x4a420c
push eax
call fcn.00477510
pop esi
add esp, 0x100
ret
mov edx, dword [0x4c8d38]
mov ecx, dword [0x4c4a14]
push 1
push 0
push 0xffffffffffffffff
push 0x4a18e4
push edx
mov dword [ecx + 0x30], 0
call fcn.00477510
mov edx, esi
lea eax, [esp + 4]
call fcn.00475660
push 1
push 0
push 0xffffffffffffffff
push eax
mov eax, dword [0x4c8480]
push eax
call fcn.00477510
pop esi
add esp, 0x100
ret
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x441d2a
mov ecx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push ecx
call fcn.00477510
pop esi
add esp, 0x100
ret
push 0x4a1868
push 0
push 0x4a420c
mov ecx, edi
call fcn.0042e110
pop esi
add esp, 0x100
ret

Function at 0x441d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
mov edi, eax
cmp word [eax], bx
je 0x441e16
nop
movzx esi, word [edi]
test esi, 0xffffff80
jne 0x441d8d
push 2
push esi
call fcn.0048ee7e
add esp, 8
test eax, eax
je 0x441d8d
and esi, 0xffffffdf
movzx eax, si
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x441d9f.44
movzx eax, byte [eax + 0x441e68]
jmp dword [eax*4 + 0x441e44]
movzx ebx, word [edi]
jmp case.0x441d9f.44
mov eax, 1
jmp 0x441dda
mov eax, 0x20
jmp 0x441dda
mov eax, 4
jmp 0x441dda
mov eax, 2
jmp 0x441dda
mov eax, 0x80
jmp 0x441dda
mov eax, 0x1000
jmp 0x441dda
mov eax, 0x100
mov ecx, ebx
sub ecx, 0x2b
je 0x441dfd
sub ecx, 2
je 0x441df1
sub ecx, 0x31
jne case.0x441d9f.44
xor dword [esp + 0x14], eax
jmp case.0x441d9f.44
not eax
and dword [esp + 0x10], eax
and dword [esp + 0x14], eax
jmp case.0x441d9f.44
mov ecx, eax
not ecx
and dword [esp + 0x10], ecx
or dword [esp + 0x14], eax
add edi, 2
cmp word [edi], 0
jne 0x441d70
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x2c]
push 0x441ea0
push eax
push ecx
mov ecx, dword [esp + 0x34]
push edx
call fcn.00441ee0
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4426e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x4c8480]
sub esp, 0x258
push ebx
push esi
call fcn.00413b70
test edi, edi
je 0x44284d
cmp word [edi], 0
je 0x44284d
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x442741
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x4427ac
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x44278d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c4a14]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x442881
mov edx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push edx
call fcn.00477510
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
or ecx, dword [esp + 0x30]
xor esi, esi
or eax, esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
jmp 0x4427b4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [ebp + 0xc]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x4427dc
push 2
push esi
call fcn.0048ee7e
mov ecx, dword [esp + 0x10]
add esp, 8
test eax, eax
mov eax, dword [esp + 0xc]
je 0x4427dc
and esi, 0xffffffdf
movzx edx, si
sub edx, 0x4b
je 0x4427f1
sub edx, 2
jne 0x442807
push edx
push 0x100000
jmp 0x4427f8
push 0
push 0x400
push eax
push ecx
call fcn.0049c5d0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov ecx, dword [0x4c8d38]
mov eax, dword [0x4c4a14]
push 1
push 0
push 0xffffffffffffffff
push 0x4a18e4
push ecx
mov dword [eax + 0x30], 0
call fcn.00477510
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0x18
push edx
push eax
mov eax, dword [0x4c8480]
call fcn.004010e0
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4c4a14]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x442881
mov ecx, dword [0x4c8d38]
push 1
push 0
push 0xffffffffffffffff
push 0x4a420c
push ecx
call fcn.00477510
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x4a1868
push 0
push 0x4a420c
call fcn.0042e110
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8