joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100509bd
Capabilities:
Get common file path

Disassembly:
push 0x22c
mov eax, 0x10069680
call fcn.100540ea
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x238], ebx
call fcn.100552a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0xc], 1
jne 0x10050a17
push str.projonepodlp
jmp 0x10050a22
cmp dword [ebp + 0xc], 2
jne 0x10050a4a
push str.projonepotcm
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp edi, ebx
je 0x10050a41
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
jmp 0x10050a9c
cmp dword [ebp + 0xc], ebx
jne 0x10050a97
push ebx
lea eax, [ebp - 0x234]
push 2
push eax
call fcn.100509bd
add esp, 0xc
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], ebx
call fcn.10002760
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push edi
test eax, eax
je 0x10050a93
push 2
push esi
call fcn.100509bd
add esp, 0xc
lea ecx, [ebp - 0x234]
call fcn.10002740
jmp 0x10050aa3
push 1
jmp 0x10050a7d
push 0x10074d80
mov ecx, esi
call fcn.100082b0
mov eax, esi
call fcn.1005416d
ret

Function at 0x10050b8f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006a836
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x10080060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
and dword [esp + 0xc], 0
test byte [0x10106f00], 1
mov edi, 0x10106ee4
jne 0x10050be6
or dword [0x10106f00], 1
mov ecx, edi
call fcn.1000be70
push 0x1006e124
call fcn.100530b4
pop ecx
mov ecx, edi
call fcn.10002670
test al, al
je 0x10050c2f
mov ecx, fcn.10050b8f
lea esi, [esp + 0x10]
call fcn.10050aee
and dword [esp + 0x38], 0
push eax
mov ecx, edi
call fcn.1000bea0
or dword [esp + 0x38], 0xffffffff
mov ecx, esi
call fcn.10002740
mov ecx, edi
call fcn.10002670
test al, al
je 0x10050c2f
push str._unknown_
mov ecx, edi
call fcn.100264f0
mov ecx, dword [ebp + 8]
push edi
call fcn.100082f0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10050c4d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.1005e830
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10050d2d
test al, al
je 0x10050d17
xor eax, eax
mov word [ebp - 0x804], ax
mov word [ebp - 0x1004], ax
push str.__ls__ls
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x10075ef0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2020]
push eax
call fcn.10050b8f
pop ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.10002760
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x2020]
call fcn.10002740
xor eax, eax
mov word [ebp - 0x2004], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1004]
push eax
push 0x800
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052989
leave
ret

Function at 0x1005143e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x10051476
push dword [ebp + 0x10]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.1005106f
add esp, 0xc
mov eax, edi
pop edi
leave
ret 0xc

Function at 0x10051ab5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
test edx, edx
je 0x10051ad9
push esi
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10081828]
dec edx
inc ecx
test edx, edx
jne 0x10051abd
pop esi
not eax
ret

Function at 0x10051d5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10051d79
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10051d75
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10051e94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.1005205a
mov bl, al
mov al, dl
call fcn.1005205a
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.1005205a
mov bl, al
mov al, byte [esi - 4]
call fcn.1005205a
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.1005205a
mov bl, al
mov al, byte [esi]
call fcn.1005205a
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.1005205a
mov bl, al
mov al, byte [esi - 0xc]
call fcn.1005205a
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x10051ebc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052989
leave
ret 4

Function at 0x10051f49
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10080060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.100520d6
push ebx
mov dl, al
call fcn.100520af
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1005206a
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10052088
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1005206a
push ebx
mov byte [ebp - 0x15], al
call fcn.10052088
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.100520af
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.100520d6
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.100520af
mov bl, al
mov al, byte [edi + 4]
call fcn.100520d6
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10052088
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1005206a
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10052088
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1005206a
xor bl, al
mov al, dl
call fcn.100520d6
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.100520af
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10051f75
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052989
leave
ret 4
Function at 0x1005272e
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x10069581
call fcn.100540ea
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1005274c
sub eax, ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.10002560
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x1005283a
movsx eax, byte [edi + esi]
mov al, byte [eax + 0x10071988]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10052780
cmp al, 0xff
je 0x1005276c
cmp al, 0xff
je 0x1005283a
movsx ecx, byte [edi + esi]
mov cl, byte [ecx + 0x10071988]
inc esi
mov byte [ebp - 0x31], cl
cmp esi, dword [ebp - 0x30]
jae 0x100527a0
cmp cl, 0xff
je 0x10052788
cmp cl, 0xff
je 0x1005283a
sar cl, 4
and cl, 3
shl al, 2
or cl, al
movzx eax, cl
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.10005210
mov al, byte [edi + esi]
inc esi
cmp al, 0x3d
je 0x1005283a
movsx eax, al
mov bl, byte [eax + 0x10071988]
cmp esi, dword [ebp - 0x30]
jae 0x100527dd
cmp bl, 0xff
je 0x100527c2
cmp bl, 0xff
je 0x1005283a
mov al, byte [ebp - 0x31]
mov cl, bl
sar cl, 2
and cl, 0xf
shl al, 4
or cl, al
movzx eax, cl
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.10005210
mov al, byte [edi + esi]
inc esi
cmp al, 0x3d
je 0x1005283a
movsx eax, al
mov al, byte [eax + 0x10071988]
cmp esi, dword [ebp - 0x30]
jae 0x1005281a
cmp al, 0xff
je 0x10052800
cmp al, 0xff
je 0x1005283a
shl bl, 6
or bl, al
movzx eax, bl
push eax
push 1
lea ecx, [ebp - 0x2c]
call fcn.10005210
cmp esi, dword [ebp - 0x30]
jb 0x1005276c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.100025d0
lea ecx, [ebp - 0x2c]
call fcn.10002610
mov eax, dword [ebp - 0x38]
call fcn.1005416d
ret

Function at 0x10052989
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10080060]
jne 0x10052993
repz ret
jmp fcn.1005418b
Function at 0x1005a749
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1005461f
and dword [ebp - 4], 0
cmp dword [0x10082e14], 0
mov ebx, eax
jne 0x1005a7fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1005a8ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1005a8ab
push eax
call fcn.100545ad
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10082e14], eax
call esi
push eax
call fcn.100545ad
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10082e18], eax
call esi
push eax
call fcn.100545ad
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10082e1c], eax
call esi
push eax
call fcn.100545ad
pop ecx
mov dword [0x10082e24], eax
test eax, eax
je 0x1005a7fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100545ad
pop ecx
mov dword [0x10082e20], eax
mov eax, dword [0x10082e20]
cmp eax, ebx
je 0x1005a852
cmp dword [0x10082e24], ebx
je 0x1005a852
push eax
call fcn.10054628
push dword [0x10082e24]
mov esi, eax
call fcn.10054628
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1005a852
test edi, edi
je 0x1005a852
call esi
test eax, eax
je 0x1005a849
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1005a849
test byte [ebp - 0xc], 1
jne 0x1005a852
or dword [ebp + 0x10], 0x200000
jmp 0x1005a88b
mov eax, dword [0x10082e18]
cmp eax, ebx
je 0x1005a88b
push eax
call fcn.10054628
pop ecx
test eax, eax
je 0x1005a88b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1005a88b
mov eax, dword [0x10082e1c]
cmp eax, ebx
je 0x1005a88b
push eax
call fcn.10054628
pop ecx
test eax, eax
je 0x1005a88b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10082e14]
call fcn.10054628
pop ecx
test eax, eax
je 0x1005a8ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1005a8ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4e04e7]
shl eax, 2
mov dword [0x4e04eb], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004d4794
pop edx
call fcn.004d3b30
call fcn.004d4798
push 0
call fcn.004d576c
pop ecx
push 0x4e0490
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4e04ef], eax
push 0
jmp fcn.004dcf44
Function at 0x41cb92
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0
cmp dword [ebp + 0xc], 0
je 0x41cba8
mov eax, 2
jmp 0x41cbaa
xor eax, eax
push eax
push 0
xor edx, edx
mov dl, bl
push edx
call sub.USER32.DLL_MapVirtualKeyA
push eax
push ebx
call sub.USER32.DLL_keybd_event
pop ebx
pop ebp
ret
Function at 0x4221bf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push ebx
call sub.USER32.DLL_BeginPaint
mov esi, eax
push ebx
call sub.USER32.DLL_GetWindowTextLengthA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
inc eax
push eax
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
push 0
push 0
push 0x31
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_SendMessageA
push eax
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 8], eax
lea eax, [ebp - 0x58]
push eax
push ebx
call sub.USER32.DLL_GetClientRect
push 1
push esi
call sub.GDI32.DLL_SetBkMode
mov edx, dword [ebp - 4]
inc edx
push edx
push edi
push ebx
call sub.USER32.DLL_GetWindowTextA
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0xffffffffffffffff
push edi
push esi
call sub.USER32.DLL_DrawTextA
push edi
call sym.SISCOM.EXE__hb_xfree
pop ecx
push dword [ebp - 8]
push esi
call sub.GDI32.DLL_SelectObject
lea eax, [ebp - 0x48]
push eax
push ebx
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42225f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
push ebx
call sub.USER32.DLL_BeginPaint
mov esi, eax
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetDC
mov dword [ebp - 8], eax
call fcn.00421a78
lea eax, [ebp - 0x70]
push eax
push ebx
call sub.USER32.DLL_GetClientRect
push 0x658afe
push ebx
call dword [0x6589c8]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.USER32.DLL_ClientToScreen
lea edx, [ebp - 0x10]
push edx
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_ScreenToClient
push 0xcc0020
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x6c]
push ecx
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_BitBlt
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x68], 0x10
push 0
push 0
push 0xf0
push ebx
call sub.USER32.DLL_SendMessageA
dec eax
jne 0x422325
push 0
lea ecx, [ebp - 0x70]
push ecx
push 5
push 2
push esi
push dword [ebp - 4]
call dword [0x6589cc]
jmp 0x422339
push 0
lea eax, [ebp - 0x70]
push eax
push 1
push 2
push esi
push dword [ebp - 4]
call dword [0x6589cc]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], 0xf
push ebx
call sub.USER32.DLL_GetWindowTextLengthA
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
push edi
push ebx
call sub.USER32.DLL_GetWindowTextA
push 0
push 0
push 0xffffffffffffffff
push edi
push 1
push 1
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
add edx, edx
push edx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0x31
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_SendMessageA
push eax
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push edi
push 1
push 1
call sub.KERNEL32.DLL_MultiByteToWideChar
add dword [ebp - 0x70], 2
add dword [ebp - 0x6c], 5
add dword [ebp - 0x64], 5
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x1c]
push 0
push 2
push esi
push dword [ebp - 4]
call dword [0x6589d8]
push dword [ebp - 0x20]
push esi
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0x1c]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push edi
call sym.SISCOM.EXE__hb_xfree
pop ecx
push dword [ebp - 4]
call dword [0x6589d4]
push dword [ebp - 8]
push ebx
call sub.USER32.DLL_GetParent
push eax
call sub.USER32.DLL_ReleaseDC
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43173b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call sub.KERNEL32.DLL_OutputDebugStringA
test ebx, ebx
jne 0x431759
push esi
call fcn.004d4a58
pop ecx
mov ebx, eax
cmp dword [0x65a068], 0
je 0x431767
call fcn.00438701
test ebx, ebx
jbe 0x431775
push ebx
push esi
call fcn.00438ecf
add esp, 8
cmp dword [0x65a068], 0
je 0x431783
call fcn.00438725
pop esi
pop ebx
pop ebp
ret

Function at 0x434be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push esi
call fcn.00437224
add esp, 8
mov esi, eax
push esi
call fcn.004d4a58
pop ecx
mov ebx, eax
jmp 0x434c0c
dec ebx
test ebx, ebx
je 0x434c27
movsx eax, byte [esi + ebx - 1]
push eax
push 0x65a2d0
call fcn.004d4988
add esp, 8
test eax, eax
jne 0x434c0b
test ebx, ebx
je 0x434c47
cmp ebx, 0x107
jg 0x434c47
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x434c42
xor edi, edi
jmp 0x434c47
mov edi, eax
and edi, 0x10
push 0
call fcn.0043755b
pop ecx
cmp dword [ebp - 4], 0
je 0x434c5e
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x435dbe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
je 0x435dcc
xor eax, eax
jmp 0x435dd1
mov eax, 1
push eax
push dword [ebp + 8]
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.00437571
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4362eb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0046a604
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
test ebx, ebx
je 0x436329
mov ax, word [ebp - 4]
jmp 0x43632b
xor eax, eax
mov ebx, eax
cmp bx, 0xffff
jne 0x436336
xor ebx, ebx
call fcn.0046a5ff
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x436341
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.0046a604
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x43637a
push 0
lea edx, [ebp - 4]
push edx
movzx ecx, si
push ecx
push dword [ebp + 0xc]
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
mov ebx, eax
jmp 0x43638e
xor eax, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
test ebx, ebx
je 0x4363a3
mov dx, word [ebp - 4]
jmp 0x4363a5
xor edx, edx
mov ebx, edx
call fcn.0046a5ff
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4363b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0046a604
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x4363ed
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0046a604
test esi, esi
je 0x43642b
push 0
push 0
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.00437571
add esp, 8
jmp 0x436443
push 0
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x436450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c4d16
test eax, eax
je 0x4364bd
call fcn.0046a604
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d48a8
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_ReadFile
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
jmp 0x4364f7
call fcn.0046a604
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00436965
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x4364ed
cmp eax, dword [ebp + 0x14]
jne 0x4364ed
push edi
push esi
push ebx
call fcn.004363b3
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4364f2
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046a5ff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436501
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c4d16
test eax, eax
je 0x43656e
call fcn.0046a604
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d48a8
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00435820
pop ecx
push eax
call sub.KERNEL32.DLL_WriteFile
push eax
call fcn.00437571
add esp, 8
call fcn.0046a5ff
jmp 0x4365a8
call fcn.0046a604
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00436965
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x43659e
cmp eax, dword [ebp + 0x14]
jne 0x43659e
push edi
push esi
push ebx
call fcn.004363ed
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4365a3
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046a5ff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x436a82
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00437224
add esp, 8
mov ebx, eax
call fcn.0046a604
push ebx
call sub.KERNEL32.DLL_DeleteFileA
mov ebx, eax
push 0
push ebx
call fcn.00437571
add esp, 8
call fcn.0046a5ff
cmp dword [ebp - 4], 0
je 0x436ac5
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret