joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d140
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [0x4ddf18]
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.004486e0
mov ebx, eax
test ebx, ebx
je 0x43d170
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
jmp 0x43d175
mov edi, 1
push 1
push 0
lea eax, [edi - 1]
mov ecx, esi
push eax
push 0
call fcn.0047b2f0
cmp eax, 1
je 0x43d193
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov ecx, esi
test ebx, ebx
je 0x43d221
push edi
push 0
push 1
call fcn.00401490
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [esi + 0x17], 0
mov ebx, eax
jne 0x43d1bc
mov edi, dword [esi + 0xc]
jmp 0x43d1be
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43d1d6
test byte [edi + 0x15], 8
je 0x43d1d1
mov ecx, edi
call fcn.004013b0
add edi, 0xc
jmp 0x43d1db
mov edi, 0x4db430
lea eax, [ebx + ebx]
mov dword [edi], eax
cmp byte [esi + 0x17], 0
jne 0x43d1eb
mov edi, dword [esi + 0xc]
jmp 0x43d1ed
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43d205
test byte [edi + 0x15], 8
je 0x43d200
mov ecx, edi
call fcn.004013b0
add edi, 0xc
jmp 0x43d20a
mov edi, 0x4db430
cmp dword [edi], 2
jae 0x43d25e
push 0
push 1
mov ecx, esi
call fcn.00401490
xor ecx, ecx
mov word [eax], cx
jmp 0x43d25e
push 0
push 1
call fcn.00401490
xor ecx, ecx
mov word [eax], cx
cmp byte [esi + 0x17], cl
jne 0x43d239
mov edi, dword [esi + 0xc]
jmp 0x43d23b
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43d253
test byte [edi + 0x15], 8
je 0x43d24e
mov ecx, edi
call fcn.004013b0
add edi, 0xc
jmp 0x43d258
mov edi, 0x4db430
mov dword [edi], 0
cmp byte [esi + 0x17], 0
jne 0x43d267
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x43d287
cmp dword [0x4dec1c], 0
je 0x43d287
push ecx
mov ecx, 0x4dec10
call fcn.00404e90
pop edi
pop esi
pop ebx
ret 0x10
and byte [esi + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x43e050
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004ab360
push esi
mov esi, dword [0x4ddf18]
lea eax, [esp + 4]
push edi
push 0x7fff
push eax
push dword [esp + 0x10014]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
push 1
cmp edi, 0x7fff
jb 0x43e116
push 1
lea ecx, [edi - 1]
push ecx
push 0
mov ecx, esi
call fcn.0047b2f0
test eax, eax
jne 0x43e0a7
pop edi
pop esi
add esp, 0x10000
ret 4
push edi
push 0
push 1
mov ecx, esi
call fcn.00401490
push eax
push dword [esp + 0x10014]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x43e0d4
push eax
push 1
mov ecx, esi
call fcn.00401490
xor ecx, ecx
mov word [eax], cx
cmp byte [esi + 0x17], 0
jne 0x43e0dd
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x43e102
cmp dword [0x4dec1c], 0
je 0x43e102
push ecx
mov ecx, 0x4dec10
call fcn.00404e90
pop edi
pop esi
add esp, 0x10000
ret 4
and byte [esi + 0x15], 0x86
mov eax, 1
pop edi
pop esi
add esp, 0x10000
ret 4
push 0
test edi, edi
lea eax, [esp + 0x10]
mov ecx, 0x4c602c
cmove eax, ecx
mov ecx, esi
push edi
push eax
call fcn.0047b2f0
pop edi
pop esi
add esp, 0x10000
ret 4
Function at 0x4407b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push ebp
push dword [0x4deba4]
mov esi, ecx
push str.__s_s
push 0x800
push esi
call fcn.004782d0
mov edi, eax
add esp, 0x14
lea ecx, [edi + 1]
cmp ecx, 0x800
jg 0x440807
lea ecx, [esi + 2]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x440807
mov ecx, dword [esp + 0x18]
mov dword [esi + edi*2], 0x22
mov eax, dword [0x4deba4]
pop edi
pop esi
mov dword [ecx], eax
mov al, 1
pop ebp
ret
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.00440d60
test eax, eax
je 0x44085a
push ebp
push edi
push str.__s_s
push 0x800
push esi
call fcn.004782d0
mov ebp, eax
add esp, 0x14
lea ecx, [ebp + 1]
cmp ecx, 0x800
jg 0x44085a
lea ecx, [esi + 2]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44085a
mov eax, dword [esp + 0x18]
mov dword [esi + ebp*2], 0x22
mov dword [eax], edi
mov al, 1
pop edi
pop esi
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebp
ret

Function at 0x440860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x2214
call fcn.004ab360
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov bl, dl
push eax
lea eax, [esp + 0x1c]
mov edi, 0x4c602c
push eax
lea esi, [esp + 0x1228]
push ecx
mov ecx, esi
call fcn.004407b0
add esp, 0xc
test al, al
jne 0x4408a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2214
ret
test bl, bl
je 0x440911
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x220]
push str.TtisBandig.exe
push ebx
push str.__s_s
push 0x800
push eax
call fcn.004782d0
mov ebp, eax
add esp, 0x14
lea ecx, [ebp + 1]
cmp ecx, 0x800
jg 0x4408fc
lea eax, [esp + 0x222]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4408fc
mov dword [esp + ebp*2 + 0x220], 0x22
lea esi, [esp + 0x220]
jmp 0x44090a
cmp ebx, dword [0x4deba4]
jne 0x440911
mov esi, dword [0x4deba0]
lea edi, [esp + 0x1220]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push esi
mov ecx, 0x4de0d0
call fcn.00436160
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x2214
ret
Function at 0x444080
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov edi, dword [0x4ddf18]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 8]
xor edx, edx
push eax
push ecx
push 0
mov ecx, esi
call fcn.00416d70
mov bl, al
add esp, 0xc
test bl, bl
jne 0x444120
push 0
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.004546a0
add esp, 4
test eax, eax
jne 0x4440e4
push 1
push eax
push 0xffffffffffffffff
push 0x4c602c
mov ecx, edi
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0
push ecx
mov ecx, eax
mov dword [esp + 0x20], 0
call fcn.00454950
add esp, 8
lea eax, [esp + 0x10]
mov ecx, edi
fstp st(0)
push eax
call fcn.0047abe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
movzx esi, word [eax]
test esi, 0xffffff80
jne 0x444140
push 2
push esi
call fcn.00498ea3
add esp, 8
test eax, eax
je 0x444140
and esi, 0xffffffdf
movzx eax, si
cmp eax, 0x50
je 0x444157
xor ecx, ecx
mov edx, 2
cmp eax, 0x54
cmovne edx, ecx
jmp 0x44415c
mov edx, 1
mov cl, bl
call fcn.004548b0
push 1
test al, al
mov edx, 0x4d05b4
push 0
mov ecx, 0x4d05b0
cmove ecx, edx
push 0xffffffffffffffff
push ecx
mov ecx, edi
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x444190
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x238
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4ddf18]
push 0
call fcn.0047b2f0
mov eax, dword [ebp + 8]
test eax, eax
je 0x444331
cmp word [eax], 0
je 0x444331
push 0x104
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0049ef24
add esp, 0xc
lea ecx, [esp + 0x30]
xor eax, eax
lea edx, [ecx + 2]
mov word [esp + 0x238], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4441f0
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x2e], 0x5c
je 0x44421d
lea eax, [ecx + 1]
cmp eax, 0x105
jae 0x444331
mov dword [esp + ecx*2 + 0x30], 0x5c
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4e02fc]
cmp eax, dword [ecx + 4]
jle 0x444271
push 0x4e02fc
call fcn.00490bb6
add esp, 4
cmp dword [0x4e02fc], 0xffffffff
jne 0x444271
push str.GetDiskFreeSpaceExW
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e02fc
mov dword [0x4e0300], eax
call fcn.00490b77
add esp, 4
mov eax, dword [0x4e0300]
test eax, eax
je 0x4442c0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x444331
cmp byte [ebp + 0xc], 0
je 0x4442af
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x4442ff
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
shrd esi, edi, 0x14
shr edi, 0x14
jmp 0x4442ff
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x444331
cmp byte [ebp + 0xc], 0
mov esi, dword [esp + 8]
cmovne esi, dword [esp + 0xc]
imul esi, dword [esp + 0x10]
imul esi, dword [esp + 0x14]
shr esi, 0x14
xor edi, edi
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
mov ecx, dword [0x4ddf18]
push 0x18
push edi
push esi
call fcn.00401330
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x44435d
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x4c602c
push 0
push 0x4c8740
mov ecx, esi
call fcn.00434ec0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4461e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x21c
push esi
push edi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x44624e
cmp byte [0x4debac], al
je 0x4462fc
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x44622e
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
add esp, 0x21c
ret
mov ecx, dword [0x4de700]
push 0x4c602c
push 0
push 0x4c8740
call fcn.00434ec0
pop edi
pop esi
add esp, 0x21c
ret
cmp byte [0x4debac], 0
lea eax, [esp + 0x18]
mov edi, 0x4db558
cmove edi, eax
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4462c5
cmp word [esi], 0
je 0x4462dd
cmp word [esi + 2], 0x3a
jne 0x4462dd
cmp word [esi + 4], 0
jne 0x4462dd
push edi
push esi
call fcn.0049466a
add esp, 8
test eax, eax
je 0x4462dd
push esi
lea eax, [esp + 0xc]
push 0x4d0a48
push eax
call fcn.00404b00
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x4462dd
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x4462dd
push 0x103
push esi
push edi
call fcn.0049ef24
add esp, 0xc
xor eax, eax
mov word [edi + 0x206], ax
cmp byte [0x4debac], 0
je 0x4462fc
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
pop edi
pop esi
add esp, 0x21c
ret
Function at 0x446930
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
je 0x446a6c
cmp word [edi], 0
je 0x446a6c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x446982
shr eax, 4
mov ecx, ebx
not al
and al, 1
push 0xb7
movzx eax, al
push eax
call fcn.00435120
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5c
push edi
call fcn.00492647
mov edx, eax
add esp, 8
mov dword [esp + 0xc], edx
cmp edx, edi
jbe 0x446a48
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4469a0
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jb 0x4469f2
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x6f
jne 0x4469eb
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
jmp 0x446a85
mov esi, edx
lea eax, [esp + 0x10]
sub esi, edi
sar esi, 1
push esi
push edi
push eax
call fcn.0049ef24
xor eax, eax
add esp, 0xc
mov word [esp + esi*2 + 0x10], ax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
call fcn.00446930
mov eax, dword [esp + 0xc]
cmp word [eax + 2], 0
je 0x446a3a
mov ecx, dword [0x4db768]
push 0
push 1
call fcn.00401490
cmp word [eax], 0x31
jne 0x446a48
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xffffffffffffffff
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.00435120
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
je 0x4469cc
push 0x4c602c
push 0
push 0x4c8740
call fcn.00434ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4476e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
push edi
test esi, esi
je 0x44772f
push 0
push 1
mov ecx, esi
call fcn.00401490
cmp byte [esi + 0x17], 0
mov ebx, eax
jne 0x44770a
mov edi, dword [esi + 0xc]
jmp 0x44770c
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x447726
test byte [edi + 0x15], 8
je 0x44771f
mov ecx, edi
call fcn.004013b0
lea eax, [edi + 0xc]
mov eax, dword [eax]
jmp 0x447765
mov eax, 0x4db430
mov eax, dword [eax]
jmp 0x447765
lea eax, [esp + 0xc]
xor ecx, ecx
push eax
lea edx, [esp + 0x20]
call fcn.0047ad20
add esp, 4
test eax, eax
jne 0x44775d
mov eax, dword [0x4d89c0]
pop edi
pop esi
pop ebx
mov dword [eax + 0x30], 0
xor eax, eax
add esp, 8
ret 8
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push ebp
xor edi, edi
mov dword [esp + 0x20], eax
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4477b6
mov edi, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
test ebx, ebx
je 0x4477a9
push ecx
lea eax, [esp + 0x20]
push eax
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, edi
sete al
mov dword [esp + 0x20], eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
mov dword [ecx + 0x30], eax
cmp ebp, 0xffffffff
je 0x4477d1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
test esi, esi
jne 0x4477df
push ebx
call fcn.00495d53
add esp, 4
test edi, edi
je 0x447802
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x44782f
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
push 0x4c602c
push 0
push 0x4c8740
call fcn.00434ec0
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x447930
Capabilities:
Copy file
Set current directory

Disassembly:
sub esp, 0x208
push ebp
push esi
mov esi, dword [esp + 0x21c]
mov ebp, ecx
push edi
mov ecx, esi
call fcn.00403e00
test al, al
je 0x44795c
push 0x10
push 0
push esi
call fcn.00495c2d
add esp, 0xc
jmp 0x447965
push esi
call fcn.00495cca
add esp, 4
push ebx
push 0
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x104
push dword [esp + 0x22c]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [0x4deb98]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call esi
xor eax, eax
cmp edi, 1
setne al
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x224]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
push 0x4db558
setne bl
call esi
test bl, bl
pop ebx
je 0x4479dd
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
pop edi
pop esi
pop ebp
add esp, 0x208
ret 0xc
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
jne 0x447a0d
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebp
add esp, 0x208
ret 0xc
push 0x4c602c
push 0
push 0x4c8740
mov ecx, ebp
call fcn.00434ec0
pop edi
pop esi
pop ebp
add esp, 0x208
ret 0xc

Function at 0x447a30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x100
push esi
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
mov ecx, dword [0x4ddf18]
push 0
call fcn.0047b2f0
mov eax, dword [esp + 0x108]
test eax, eax
je 0x447b14
cmp word [eax], 0
je 0x447b14
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x447aca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jne 0x447aac
mov ecx, dword [0x4db768]
push 1
push 0
push edi
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
add esp, 0x100
ret 4
push 0x4c602c
push 0
push 0x4c8740
mov ecx, esi
call fcn.00434ec0
pop edi
pop esi
add esp, 0x100
ret 4
mov eax, dword [0x4d89c0]
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
mov dword [eax + 0x30], 0
call fcn.0047b2f0
mov edx, edi
lea ecx, [esp + 8]
call fcn.00479300
mov ecx, dword [0x4ddf18]
push 1
push 0
push 0xffffffffffffffff
push eax
call fcn.0047b2f0
pop edi
pop esi
add esp, 0x100
ret 4
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x447b49
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop esi
add esp, 0x100
ret 4
push 0x4c602c
push 0
push 0x4c8740
mov ecx, esi
call fcn.00434ec0
pop esi
add esp, 0x100
ret 4
Function at 0x447b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
or ebx, 0xffffffff
mov dword [esp + 0x10], 0
mov eax, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
cmp word [edi], dx
je 0x447c59
movzx esi, word [edi]
test esi, 0xffffff80
jne 0x447bc8
push 2
push esi
call fcn.00498ea3
mov edx, dword [esp + 0x24]
add esp, 8
mov ebx, dword [esp + 0x18]
test eax, eax
je 0x447bc8
and esi, 0xffffffdf
movzx eax, si
add eax, 0xffffffd5
cmp eax, 0x33
ja case.0x447bda.44
movzx eax, byte [eax + 0x447ca4]
jmp dword [eax*4 + 0x447c80]
movzx eax, word [edi]
mov dword [esp + 0x10], eax
jmp case.0x447bda.44
mov ecx, 1
jmp 0x447c19
mov ecx, 0x20
jmp 0x447c19
mov ecx, 4
jmp 0x447c19
mov ecx, 2
jmp 0x447c19
mov ecx, 0x80
jmp 0x447c19
mov ecx, 0x1000
jmp 0x447c19
mov ecx, 0x100
mov eax, dword [esp + 0x10]
sub eax, 0x2b
je 0x447c38
sub eax, 2
je 0x447c30
sub eax, 0x31
jne case.0x447bda.44
xor edx, ecx
jmp 0x447c44
not ecx
and ebx, ecx
and edx, ecx
jmp 0x447c40
mov eax, ecx
not eax
and ebx, eax
or edx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
add edi, 2
cmp word [edi], 0
jne 0x447ba3
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x447ce0
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00447d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x448490
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov ecx, dword [0x4ddf18]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x2c], esi
call fcn.0047b2f0
mov edi, dword [ebp + 8]
test edi, edi
je 0x4485e2
cmp word [edi], 0
je 0x4485e2
push 0
push 0
push 3
push 0
push 7
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x448507
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x44854c
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x448533
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jmp 0x4485f5
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x3c]
xor eax, eax
or eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx esi, word [eax]
test esi, 0xffffff80
jne 0x44856c
push 2
push esi
call fcn.00498ea3
add esp, 8
test eax, eax
je 0x44856c
and esi, 0xffffffdf
movzx eax, si
sub eax, 0x4b
je 0x448581
sub eax, 2
jne 0x44859d
push eax
push 0x100000
jmp 0x448588
push 0
push 0x400
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.004abb30
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [0x4d89c0]
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
mov dword [eax + 0x30], 0
call fcn.0047b2f0
mov ecx, dword [0x4ddf18]
push 0x18
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.00401330
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x4d89c0]
test byte [eax + 0x100], 1
mov dword [eax + 0x30], 0x57
jne 0x448616
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x4c602c
push 0
push 0x4c8740
mov ecx, esi
call fcn.00434ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x449e70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x449e92
xor eax, eax
mov word [esp], ax
lea edx, [esp]
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x449ea0
sub edx, ecx
sar edx, 1
jne 0x449eb5
xor edx, edx
jmp 0x449ec5
cmp word [esp + edx*2 - 2], 0x5c
jne 0x449ec5
xor eax, eax
mov word [esp + edx*2 - 2], ax
dec edx
push esi
mov esi, dword [esp + 0x210]
test esi, esi
je 0x449ef0
lea eax, [esp + 4]
mov ecx, eax
sub esi, ecx
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [esi + eax - 2], cx
test cx, cx
jne 0x449ee0
mov eax, edx
pop esi
add esp, 0x208
ret