joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43abe0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x43ac16
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004cc39d
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43ac74
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x51f14c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43ac74
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [edi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [edi + 4], cx
movzx edx, word [eax + 0xc]
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x43ac81
push esi
call fcn.004cc2c0
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x43ac90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004d3360
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43ace9
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x214
ret
push edi
push 0x51f150
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004cc943
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.0043abe0
add esp, 0x10
pop edi
test al, al
je 0x43acd2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.004cc2b1
add esp, 0x214
ret
Function at 0x43b880
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebx, eax
push edi
push ebx
call ebp
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call ebp
push esi
call dword [sym.imp.USER32.dll_IsIconic]
pop edi
pop ebp
pop ebx
test eax, eax
je 0x43b8fd
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x43c4d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50968b
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x43c57d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00438300
mov esi, eax
push 0x529ba4
push 0x51f1f4
mov edx, esi
call fcn.00439710
push edi
push 0x528d90
mov edx, esi
call fcn.00439710
add esp, 0x10
xor al, al
jmp 0x43c62b
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43c587
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x43c5c9
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x43c5b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43c5b0
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.00438f20
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.00439130
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x43c5f4
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.00439130
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x43c629
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x43c629
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x33c
ret

Function at 0x43c660
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
add esi, 0x4d4
cmp word [esi], 0
push edi
jne 0x43c699
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x43c699
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x43c699
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x43ce90
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x6dc]
call fcn.00439130
cmp byte [esi + 0x7f8], 0
lea eax, [esi + 0x6e8]
jne 0x43cebe
mov eax, dword [esi + 0x6e4]
add esi, 0x800
add eax, 4
mov edx, esi
call fcn.00439130
mov eax, esi
call fcn.00439c50
pop edi
mov al, 1
pop esi
ret

Function at 0x43dd00
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004d3360
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43dd67
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004d3360
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x43ddc7
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x424
ret
push edi
push esi
call fcn.004cc39d
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x43ddde
xor al, al
jmp 0x43de88
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43de7d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43de7d
cmp dword [esp + 0x10], 4
jb 0x43de7d
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xCompanyName
lea edx, [esp + 0x234]
call fcn.00413820
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43de7d
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x43de7d
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x43de71
mov edx, ebp
call fcn.00439130
jmp 0x43de7b
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00439190
mov bl, 1
push edi
call fcn.004cc2c0
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cc2b1
add esp, 0x424
ret
Function at 0x43f510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509f73
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x52eca4]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x52eca8]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x52ecac]
fstp dword [esi + 0x14]
call fcn.00408340
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x440160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50cf00
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], fcn.004cc39d
mov dword [esp + 0x28], fcn.004ce4c2
mov dword [esp + 0x2c], fcn.004cc2c0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x1fff8
mov dword [esp + 0x20], vtable.t_heap.0
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
mov byte [esp + 0x48], 1
call fcn.00443260
test al, al
jne 0x440238
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x440208
push eax
call fcn.004cc2c0
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.allocator_unsigned_char__class_TAllocDefault_.0
call fcn.00403460
lea ecx, [esp + 0xc]
call fcn.004382a0
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.004406c0
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x440268
push eax
call fcn.004cc2c0
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.allocator_unsigned_char__class_TAllocDefault_.0
call fcn.00403460
lea ecx, [esp + 0xc]
call fcn.004382a0
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
Function at 0x440d90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50bddb
mov eax, dword fs:[0]
push eax
sub esp, 0x370
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x368], eax
push ebx
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], ecx
call fcn.004419b0
xor esi, esi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
push esi
push ebx
lea eax, [esp + 0x24]
push eax
mov eax, edi
mov dword [esp + 0x394], esi
call fcn.00441af0
test al, al
je 0x440e76
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x440e46
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x440e46
xor edi, edi
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x374], edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x440ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x440ebc
xor eax, eax
jmp 0x440ebe
mov ecx, ebx
call fcn.00438300
push 0x528a94
push 0x51f1f4
mov edx, eax
call fcn.00439710
mov dword [esp + 0x390], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00441a20
xor al, al
jmp 0x440f10
mov eax, edi
mov esi, dword [esp + 0x18]
push eax
mov dword [esi + 8], eax
call fcn.004cc39d
mov edx, dword [esi + 8]
add esp, 4
push edx
push eax
push ebx
lea ecx, [esp + 0x374]
mov dword [esi + 4], eax
call fcn.00446be0
test al, al
je 0x440e76
mov dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00441a20
mov al, 1
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x368]
xor ecx, esp
call fcn.004cc2b1
mov esp, ebp
pop ebp
ret 8
Function at 0x441af0
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0x130]
mov edx, dword [eax + 0x18]
lea edi, [ebp + 0x130]
push esi
push ebx
mov ecx, edi
call edx
test al, al
jne 0x441b41
mov ecx, ebx
call fcn.00438300
push 0x528a94
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
push ebx
call fcn.004423b0
test al, al
je 0x441b1a
mov ebx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
mov dword [ebp + 0x348], edi
mov edi, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
mov eax, edi
mov dword [ebp + 8], ebx
call fcn.00441900
add esp, 0xc
test al, al
jne 0x441bd0
cmp byte [esi + 0x11c], al
je 0x441b94
add esi, 0xc
jmp 0x441b97
mov esi, dword [esi + 8]
mov ecx, edi
call fcn.00438300
mov edi, eax
push 0x52a30c
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esi, 4
push esi
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push edi
push 0
push eax
push ecx
mov ecx, esi
call fcn.00439650
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x441c71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x441c25
cmp ebx, 3
jge 0x441cbf
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x441c46
cmp eax, 5
jne 0x441c86
cmp ebx, 3
jge 0x441cbf
push 0x80
mov ecx, esi
call fcn.00439650
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push 0
push 0x80
push edi
push 0
push edx
push eax
mov ecx, esi
call fcn.00439650
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [ebp + 4], eax
cmp eax, 0xffffffff
je 0x441c03
push esi
lea ecx, [ebp + 0xc]
call fcn.004363f0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
test eax, eax
jne 0x441cbf
cmp byte [esi + 0x11c], al
je 0x441c97
add esi, 0xc
jmp 0x441c9a
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x20]
add esi, 4
push esi
push 0x52a31c
call fcn.00402790
mov ecx, eax
call fcn.00438c70
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x441cce
mov ebx, dword [esi + 8]
mov ecx, dword [esp + 0x20]
call fcn.00438300
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.00438b40
mov ecx, dword [esp + 0x20]
call fcn.00438300
add ebx, 4
push ebx
push 0x52a30c
mov ecx, eax
call fcn.00438c70
mov ecx, eax
call fcn.00438c70
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
Function at 0x441db0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x441dd9
test ebx, ebx
je 0x441dcf
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x441e5f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x441e0a
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00438300
mov esi, eax
push 0x52a33c
push 0x51f1f4
mov edx, esi
call fcn.00439710
add ebx, 4
push ebx
push 0x51f1f4
mov edx, esi
call fcn.00439710
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x441e69
mov dword [ebx], eax
test eax, eax
jne 0x441dcf
cmp byte [esi + 0x128], al
je 0x441e7e
add esi, 0x18
jmp 0x441e81
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00438300
mov edi, eax
push 0x52a34c
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esi, 4
push esi
push 0x51f1f4
mov edx, edi
call fcn.00439710
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x441ec0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x441f5d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x441f08
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00438300
mov esi, eax
push 0x52a36c
push 0x51f1f4
mov edx, esi
call fcn.00439710
add ebx, 4
push ebx
push 0x51f1f4
mov edx, esi
call fcn.00439710
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x441f67
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc

Function at 0x442900
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00447b60
Function at 0x442a00
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00442a60
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.004473b0
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x442a60
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x50bd2b
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x37c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38c]
lea esi, [esp + 0x1c]
mov ebx, ecx
mov edi, edx
call fcn.004419b0
xor esi, esi
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
push esi
push ebx
lea eax, [esp + 0x24]
push eax
mov eax, edi
mov dword [esp + 0x390], esi
call fcn.00441af0
test al, al
je 0x442bd8
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x442b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x442b16
mov esi, edi
push 0x100000
mov dword [esp + 0x370], esi
call fcn.004cc39d
mov edi, eax
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
je 0x442b7e
mov esi, eax
cmp eax, 0x100000
jb 0x442b4a
mov esi, 0x100000
push esi
push edi
push ebx
lea ecx, [esp + 0x374]
call fcn.00446be0
push edi
test al, al
je 0x442c13
mov eax, esi
mov ecx, ebp
call fcn.00447110
mov eax, dword [esp + 0x370]
add esp, 4
sub eax, dword [esp + 0x370]
jne 0x442b3c
push edi
call fcn.004cc2c0
mov dword [esp + 0x388], 0xffffffff
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00441a20
mov al, 1
mov ecx, dword [esp + 0x37c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x360]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x374
ret
push 0x52a52c
push ebx
call fcn.004383b0
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov bl, al
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00441a20
mov al, bl
jmp 0x442bb0
call fcn.004cc2c0
add esp, 4
mov ecx, ebx
call fcn.00438300
push 0x52a52c
push 0x51f1f4
mov edx, eax
call fcn.00439710
mov dword [esp + 0x38c], 0xffffffff
add esp, 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00441a20
xor al, al
jmp 0x442bb0