joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4317a0
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x503688
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov esi, dword [eax]
xor ebx, ebx
push 8
mov dword [esp + 0x40], ebx
call fcn.004c98d1
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4317f7
push ebx
call fcn.004c9578
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], edx
mov ebx, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0
test esi, esi
jle 0x431850
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ecx]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
push ecx
push esi
push ebp
push edx
call edi
test eax, eax
je 0x431877
push 0
call fcn.004c9578
sub eax, dword [ebx]
mov ecx, dword [esp + 0x34]
imul eax, eax, 0x3e8
add esp, 4
mov dword [esp + 0x1c], edx
cmp eax, dword [ecx]
ja 0x4318be
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x431850
sub esi, eax
add ebp, eax
test esi, esi
jg 0x431810
mov eax, dword [esp + 0x40]
sub dword [eax], esi
push ebx
call fcn.004c85c5
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
mov edi, eax
call fcn.00437ec0
mov esi, eax
call fcn.00438700
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00437ec0
push 0x520878
push 0x5192f4
mov edx, eax
call fcn.004392f0
push ebx
call fcn.004c85c5
add esp, 0xc
xor al, al
jmp 0x431861
mov ecx, dword [esp + 0x34]
call fcn.00437ec0
push 0x52088c
jmp 0x4318a5

Function at 0x431f00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x1fe
mov esi, ecx
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004cd250
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SoftWareSogouInput
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x431f71
xor al, al
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004c60f4
add esp, 0x210
ret
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x431f59
lea eax, [esp + 0x10]
mov edx, edi
call fcn.00438d30
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov al, 1
call fcn.004c60f4
add esp, 0x210
ret
Function at 0x432540
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x505c3d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
fld dword [0x526e3c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x804]
fld dword [0x526e38]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004c61e0
fld dword [0x526e34]
mov dword [esp + 0x1c], fcn.004c83aa
fstp dword [esp]
mov dword [esp + 0x20], fcn.004c6103
call fcn.00407ce0
mov dword [esp + 0x20], 0
fld dword [0x526e3c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x840]
fld dword [0x526e38]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004c61e0
fld dword [0x526e34]
mov dword [esp + 0x1c], fcn.004c83aa
fstp dword [esp]
mov dword [esp + 0x20], fcn.004c6103
call fcn.00407ce0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x890], eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x48]
mov ecx, edi
mov dword [edi + 0x88c], 0
call fcn.004324d0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18

Function at 0x436140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x43614f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436161
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x436b00
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x503fc7
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x268]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x436b51
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x51931c
push eax
call fcn.004c7005
add esp, 0xc
test eax, eax
je 0x436d54
mov ecx, esi
call fcn.00436170
test al, al
je 0x436bff
cmp byte [esp + 0x26c], 0
je 0x436d54
cmp byte [esi + 0x11c], 0
je 0x436b97
add esi, 0xc
jmp 0x436b9a
mov esi, dword [esi + 8]
lea ecx, [esp + 0xc]
call fcn.00438ae0
lea eax, [esi + 4]
lea edx, [esp + 0xc]
call fcn.00438d30
push 0x5210f8
mov ecx, ebx
mov dword [esp + 0x264], 1
call fcn.00437ec0
mov esi, eax
lea eax, [esp + 0x10]
call fcn.004388d0
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x436bf8
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x436bf8
push eax
call fcn.004c6103
add esp, 4
xor al, al
jmp 0x436d56
lea ecx, [esp + 0x130]
call fcn.00435900
lea edx, [esp + 0x130]
push edx
mov ecx, esi
mov dword [esp + 0x264], 2
call fcn.004375a0
test al, al
je 0x436c5f
lea eax, [esp + 0x130]
call fcn.00435ef0
test al, al
jne 0x436c5f
push 0
push ebx
lea ecx, [esp + 0x138]
call fcn.00436b00
test al, al
jne 0x436c5f
lea ecx, [esp + 0x130]
call fcn.00438c80
xor al, al
jmp 0x436d56
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x436c6e
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x436d16
cmp byte [esi + 0x11c], al
je 0x436c8f
add esi, 0xc
jmp 0x436c92
mov esi, dword [esi + 8]
lea ecx, [esp + 0xc]
call fcn.00438ae0
lea eax, [esi + 4]
lea edx, [esp + 0xc]
call fcn.00438d30
push 0x51b618
mov byte [esp + 0x264], 4
call fcn.004386d0
mov esi, eax
lea eax, [esp + 0x10]
call fcn.004388d0
cmp byte [esp + 0x128], 0
mov esi, vtable.t_str.0
mov dword [esp + 0xc], esi
jne 0x436cec
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x436cec
push eax
call fcn.004c6103
add esp, 4
cmp byte [esp + 0x24c], 0
mov dword [esp + 0x130], esi
jne 0x436bf8
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x13c]
cmp eax, edx
jmp 0x436bed
mov eax, esi
call fcn.00437840
mov eax, esi
call fcn.004376d0
cmp byte [esp + 0x24c], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x436d54
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x13c]
cmp eax, ecx
je 0x436d54
push eax
call fcn.004c6103
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004c60f4
add esp, 0x258
ret 8
Function at 0x437ca0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x507dbc
mov eax, dword fs:[0]
push eax
sub esp, 0x248
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x26c]
call fcn.004365e0
cmp byte [ebx + 0x11c], 0
lea ecx, [ebx + 0xc]
jne 0x437cea
mov ecx, dword [ebx + 8]
cmp byte [ebp + 0x11c], 0
lea eax, [ebp + 0xc]
jne 0x437cf9
mov eax, dword [ebp + 8]
push 2
add ecx, 4
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x437e30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x270]
mov edi, eax
call fcn.00437ec0
mov esi, eax
call fcn.00438700
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x270]
mov ecx, edi
call fcn.00437ec0
push str.MoveFileEx
push 0x5192f4
mov edx, eax
call fcn.004392f0
add esp, 8
cmp byte [ebx + 0x11c], 0
je 0x437d64
add ebx, 0xc
jmp 0x437d67
mov ebx, dword [ebx + 8]
lea ecx, [esp + 0x138]
call fcn.00438ae0
lea eax, [ebx + 4]
lea edx, [esp + 0x138]
call fcn.00438d30
mov dword [esp + 0x264], 5
cmp byte [ebp + 0x11c], 0
lea esi, [ebp + 0xc]
jne 0x437d9c
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.00438ae0
lea eax, [esi + 4]
lea edx, [esp + 0x14]
call fcn.00438d30
lea eax, [esp + 0x14]
push eax
push str._rY6R
mov ecx, edi
mov byte [esp + 0x26c], 7
call fcn.00437ec0
mov esi, eax
lea eax, [esp + 0x140]
call fcn.00438980
cmp byte [esp + 0x130], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x14], esi
jne 0x437e00
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x437e00
push eax
call fcn.004c6103
add esp, 4
cmp byte [esp + 0x254], 0
mov dword [esp + 0x138], esi
jne 0x437e2c
mov eax, dword [esp + 0x140]
lea edx, [esp + 0x144]
cmp eax, edx
je 0x437e2c
push eax
call fcn.004c6103
add esp, 4
xor al, al
jmp 0x437e32
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 8
Function at 0x439a10
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x542210
push esi
call fcn.004c63ab
add esp, 8
test eax, eax
je 0x439a56
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004c60f4
add esp, 0x804
ret
mov eax, 0x4000
test word [0x542216], ax
je 0x439b76
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.004023b0
add esp, 8
push 0x541fc0
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439b75
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x5192cc
mov eax, 0x541fec
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439ad6
test dx, dx
je 0x439ad2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439ad6
add eax, 4
add ecx, 4
test dx, dx
jne 0x439ab0
xor eax, eax
jmp 0x439adb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439b5d
mov ecx, 0x5192d0
mov eax, 0x541fec
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439b16
test dx, dx
je 0x439b12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439b16
add eax, 4
add ecx, 4
test dx, dx
jne 0x439af0
xor eax, eax
jmp 0x439b1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439b5d
push 0x541fec
push esi
push str._s_s
lea edx, [esp + 0x18]
call fcn.004023b0
add esp, 0xc
test byte [0x541fc0], 0x10
je 0x439b4e
lea edx, [esp + 0xc]
push edx
call fcn.00439a10
add esp, 4
jmp 0x439b5d
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x541fc0
push edi
call ebp
test eax, eax
jne 0x439aa0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004c60f4
add esp, 0x804
ret
Function at 0x439bb0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x804
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
push esi
mov esi, dword [esp + 0x810]
push 0x541f90
push esi
xor ebp, ebp
call fcn.004c63ab
add esp, 8
test eax, eax
je 0x439bfa
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004c60f4
add esp, 0x804
ret
mov eax, 0x4000
test word [0x541f96], ax
je 0x439d0e
push edi
push esi
push str._s.
lea edx, [esp + 0x14]
call fcn.004023b0
add esp, 8
push 0x541d40
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439cfa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x5192cc
mov eax, 0x541d6c
jmp 0x439c50
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439c76
test dx, dx
je 0x439c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x439c50
xor eax, eax
jmp 0x439c7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439ce2
mov ecx, 0x5192d0
mov eax, 0x541d6c
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439cb6
test dx, dx
je 0x439cb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439cb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x439c90
xor eax, eax
jmp 0x439cbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439ce2
push 0x541d6c
push esi
push str._s_s
lea edx, [esp + 0x1c]
call fcn.004023b0
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00439bb0
add esp, 0x14
push 0x541d40
push edi
call ebx
test eax, eax
jne 0x439c41
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
cmp byte [esp + 0x818], 0
pop edi
je 0x439d17
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x439d15
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
mov ecx, dword [esp + 0x808]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004c60f4
add esp, 0x804
ret
Function at 0x43a140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503f0c
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x3b0]
mov dword fs:[0], eax
push 0x208
xor ebx, ebx
push ebx
push esi
call fcn.004cd250
add esp, 0xc
lea ecx, [esp + 0x280]
mov dword [esp + method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00438ae0
mov eax, str.HKEY_LOCAL_MACHINE
lea edx, [esp + 0x280]
mov dword [esp + 0x278], ebx
mov dword [esp + 0x27c], reloc.WS2_32.dll_bind
call fcn.00438d30
mov dword [esp + 0x3b8], ebx
lea ecx, [esp + 0x150]
mov dword [esp + method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00438ae0
mov eax, str.HKEY_CURRENT_USER
lea edx, [esp + 0x150]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], reloc.WS2_32.dll_accept
call fcn.00438d30
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push str.SoftwareSogouExplorer
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x27c]
mov byte [esp + 0x3c0], 2
call fcn.00443fb0
test al, al
jne 0x43a25b
push str.SoftwareSogouExplorer
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x14c]
call fcn.00443fb0
test al, al
je 0x43a2f8
lea ecx, [esp + 0x144]
jmp 0x43a262
lea ecx, [esp + 0x274]
push 1
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x18]
push eax
xor eax, eax
mov dword [esp + 0x28], 0x208
call fcn.00444100
test al, al
je 0x43a2f8
push str.SogouExplorer.exe
push 0x104
push esi
call fcn.004c6786
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00438ae0
mov eax, esi
lea edx, [esp + 0x1c]
call fcn.00438d30
lea eax, [esp + 0x28]
cmp byte [esp + 0x138], bl
jne 0x43a2ba
mov eax, dword [esp + 0x24]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a2d2
shr eax, 4
not al
and al, 1
jne 0x43a31d
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x43a2f8
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x43a2f8
push eax
call fcn.004c6103
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00437e60
lea ecx, [esp + 0x144]
call fcn.00443f60
lea ecx, [esp + 0x274]
call fcn.00443f60
xor eax, eax
jmp 0x43a369
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x43a343
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x43a343
push eax
call fcn.004c6103
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00437e60
lea ecx, [esp + 0x144]
call fcn.00443f60
lea ecx, [esp + 0x274]
call fcn.00443f60
mov eax, 1
mov ecx, dword [esp + 0x3b0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.004c60f4
mov esp, ebp
pop ebp
ret
Function at 0x43a7c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x43a7f6
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004c61e0
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43a854
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x51924c
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43a854
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
movzx edx, word [eax + 8]
mov word [edi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [edi + 4], cx
movzx edx, word [eax + 0xc]
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x43a861
push esi
call fcn.004c6103
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x43a870
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004cd250
add esp, 0xc
push 0x104
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43a8c9
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004c60f4
add esp, 0x214
ret
push edi
push 0x519250
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.004c6786
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x14]
call fcn.0043a7c0
add esp, 0x10
pop edi
test al, al
je 0x43a8b2
movzx ecx, word [esp + 4]
movzx edx, word [esp]
movzx eax, word [esp + 2]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x210]
mov dword [esi + 4], edx
xor edx, edx
mov dword [esi + 8], eax
xor ecx, esp
mov dword [esi], 0x114
mov dword [esi + 0x10], 2
mov word [esi + 0x14], dx
mov al, 1
call fcn.004c60f4
add esp, 0x214
ret
Function at 0x43b460
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebx, eax
push edi
push ebx
call ebp
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call ebp
push esi
call dword [sym.imp.USER32.dll_IsIconic]
pop edi
pop ebp
pop ebx
test eax, eax
je 0x43b4dd
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x43c0b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x50352b
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x32c], eax
push esi
push edi
mov eax, dword [0x5375a0]
xor eax, esp
push eax
lea eax, [esp + 0x33c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x13a]
push ecx
mov esi, edx
mov word [esp + 0x13c], ax
call fcn.004cd250
add esp, 0xc
lea edx, [esp + 0x130]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x43c15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00437ec0
mov esi, eax
push 0x522184
push 0x5192f4
mov edx, esi
call fcn.004392f0
push edi
push 0x521370
mov edx, esi
call fcn.004392f0
add esp, 0x10
xor al, al
jmp 0x43c20b
lea eax, [esp + 0x130]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43c167
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12e], 0x5c
jne 0x43c1a9
lea eax, [esp + 0x130]
lea edx, [eax + 2]
jmp 0x43c190
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43c190
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x12e], cx
lea ecx, [esp + 0xc]
call fcn.00438ae0
lea eax, [esp + 0x130]
lea edx, [esp + 0xc]
call fcn.00438d30
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x43c1d4
mov eax, dword [esp + 0x14]
add eax, 4
lea edx, [edi + 0x130]
call fcn.00438d30
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x43c209
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x43c209
push eax
call fcn.004c6103
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x33c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004c60f4
add esp, 0x33c
ret

Function at 0x43c240
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
add esi, 0x4d4
cmp word [esi], 0
push edi
jne 0x43c279
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x43c279
push esi
push 1
push 0
push 0x23
push 0
call edi
test eax, eax
je 0x43c279
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x43ca70
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x6dc]
call fcn.00438d30
cmp byte [esi + 0x7f8], 0
lea eax, [esi + 0x6e8]
jne 0x43ca9e
mov eax, dword [esi + 0x6e4]
add esi, 0x800
add eax, 4
mov edx, esi
call fcn.00438d30
mov eax, esi
call fcn.00439830
pop edi
mov al, 1
pop esi
ret

Function at 0x43d8e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x424
mov eax, dword [0x5375a0]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [esp + 0x430]
push 0x206
xor ebx, ebx
lea ecx, [esp + 0x1e]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x24], ax
call fcn.004cd250
add esp, 0xc
push 0x104
lea edx, [esp + 0x1c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x43d947
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004c60f4
add esp, 0x424
ret
push esi
push 0x206
lea ecx, [esp + 0x22a]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x230], ax
call fcn.004cd250
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jne 0x43d9a7
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.004c60f4
add esp, 0x424
ret
push edi
push esi
call fcn.004c61e0
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x43d9be
xor al, al
jmp 0x43da68
mov ecx, dword [esp + 0x1c]
push edi
push esi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43da5d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43da5d
cmp dword [esp + 0x10], 4
jb 0x43da5d
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push edx
push eax
push str.StringFileInfo_04x_04xCompanyName
lea edx, [esp + 0x234]
call fcn.00413670
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x230]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43da5d
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jbe 0x43da5d
mov eax, dword [esp + 0x18]
cmp word [eax + ecx*2 - 2], bx
jne 0x43da51
mov edx, ebp
call fcn.00438d30
jmp 0x43da5b
push eax
mov eax, ecx
mov ebx, ebp
call fcn.00438d90
mov bl, 1
push edi
call fcn.004c6103
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c60f4
add esp, 0x424
ret