joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402620
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40266b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402664
test esi, esi
je 0x402664
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402640
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402850
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4028a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402978
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4028de
cmp eax, 4
jne 0x402900
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4028ee
cmp edx, 4
je 0x4028ee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402850
Function at 0x42c5e0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c80c
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
call fcn.0042c5a0
lea ecx, [ebp - 0x34]
call fcn.00445788
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.00444ea3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00444ea3
mov byte [ebp - 4], 3
call fcn.004500ae
mov eax, dword [eax + 4]
add eax, 0xd4
mov eax, dword [eax + 0xf0]
push eax
lea ecx, [ebp - 0x18]
call fcn.00445070
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
call fcn.00444f83
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00445385
push eax
push 0
mov eax, dword [esi + 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edi, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004453da
test edi, edi
je 0x42c695
mov eax, dword [ebp - 0x14]
push eax
call fcn.00446544
test edi, edi
jne 0x42c6f1
lea ecx, [ebp - 0x18]
call fcn.00444f83
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00445385
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004453da
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00445385
push eax
push 0
mov eax, dword [esi + 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004453da
mov eax, dword [ebp - 0x14]
push eax
call fcn.00446544
mov edi, dword [ebp + 8]
test edi, edi
je 0x42c79d
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.0043f33b
push eax
lea ecx, [ebp - 0x14]
call fcn.00445402
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004453da
push edi
lea ecx, [ebp - 0x14]
call fcn.00445330
mov ebx, 1
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00446f2f
test eax, eax
je 0x42c79d
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00445385
push eax
push ebx
mov eax, dword [esi + 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004453da
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.0043f33b
push eax
lea ecx, [ebp - 0x14]
call fcn.00445402
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.004453da
push edi
lea ecx, [ebp - 0x14]
call fcn.00445330
inc ebx
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00446f2f
test eax, eax
jne 0x42c73b
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov dword [esi + 0x18], 1
mov byte [ebp - 4], 3
call fcn.0042c7e8
mov byte [ebp - 4], 2
call fcn.0042c7f0
mov byte [ebp - 4], 1
call fcn.0042c7f8
mov dword [ebp - 4], 0xffffffff
call fcn.0042c816
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4312b0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457738
push 0x434954
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4654c4], eax
xor eax, eax
mov al, byte [0x4654c5]
mov dword [0x4654d0], eax
mov eax, dword [0x4654c4]
shr dword [0x4654c4], 0x10
and eax, 0xff
mov dword [0x4654cc], eax
shl eax, 8
add eax, dword [0x4654d0]
mov dword [0x4654c8], eax
call fcn.00433770
call fcn.004334e0
test eax, eax
jne 0x431329
push 0x10
call fcn.00431450
add esp, 4
mov dword [ebp - 4], 0
call fcn.00434770
call fcn.004321b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x46a3e0], eax
call fcn.004345d0
mov dword [0x465030], eax
test eax, eax
je 0x43135c
cmp dword [0x46a3e0], 0
jne 0x431366
push 0xffffffffffffffff
call fcn.00432860
add esp, 4
call fcn.00434360
call fcn.00434280
call fcn.00432830
mov esi, dword [0x46a3e0]
mov al, byte [esi]
cmp al, 0x22
je 0x43138d
cmp al, 0x20
jbe 0x4313ba
inc esi
cmp byte [esi], 0x20
ja 0x431385
jmp 0x4313ba
inc esi
cmp byte [esi], 0x22
je 0x4313b9
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4313b4
xor eax, eax
mov al, bl
push eax
call fcn.00434220
add esp, 4
test eax, eax
je 0x4313ae
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x431396
cmp byte [esi], 0x22
jne 0x4313ba
inc esi
cmp byte [esi], 0
je 0x4313ca
cmp byte [esi], 0x20
ja 0x4313ca
inc esi
cmp byte [esi], 0
jne 0x4313bf
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4313ee
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00432860
jmp 0x43142f
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4328a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.00432960
cmp dword [0x465500], 1
mov esi, dword [esp + 0x10]
jne 0x4328c3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4654fc], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x4654f8], bl
jne 0x43291d
cmp dword [0x46a3dc], 0
je 0x43290b
mov edi, dword [0x46a3d8]
sub edi, 4
cmp dword [0x46a3dc], edi
ja 0x43290b
mov eax, dword [edi]
test eax, eax
je 0x432900
call eax
sub edi, 4
cmp dword [0x46a3dc], edi
jbe 0x4328f8
push 0x4631a8
push 0x4631a0
call fcn.00432980
add esp, 8
push 0x4631b0
push 0x4631ac
call fcn.00432980
add esp, 8
test ebx, ebx
je 0x43293c
call fcn.00432970
pop edi
pop esi
pop ebx
ret
mov dword [0x465500], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4334e0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.004335d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x465520], eax
cmp eax, 0xffffffff
jne 0x4334fa
xor eax, eax
pop esi
ret
push 0x74
push 1
call fcn.004366e0
add esp, 8
mov esi, eax
test esi, esi
je 0x43353c
push esi
mov eax, dword [0x465520]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x43353c
push esi
call fcn.00433540
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x433560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x465520]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x4335c3
push 0x74
push 1
call fcn.004366e0
add esp, 8
mov edi, eax
test edi, edi
je 0x4335b9
push edi
mov eax, dword [0x465520]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4335b9
push edi
call fcn.00433540
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x4335c3
push 0x10
call fcn.00431450
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0x43a620
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x4667bc]
push esi
test eax, eax
push edi
push ebp
jne 0x43a668
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 1
push 0
call esi
test eax, eax
je 0x43a648
mov eax, 1
jmp 0x43a66e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x43a661
mov eax, 2
jmp 0x43a66e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [0x4667bc], eax
cmp eax, 1
jne 0x43a693
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x4667bc], eax
cmp eax, 2
jne 0x43a721
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x43a6af
mov edi, dword [0x4658a8]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
test ebp, ebp
jne 0x43a6d0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push ebp
call fcn.00430eb0
add esp, 4
mov esi, eax
test esi, esi
jne 0x43a6e6
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x43a716
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x43a726
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0x43a73e
push esi
call fcn.00430e90
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x43a716
push esi
call fcn.00430e90
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x440d44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x10]
mov eax, edi
mov dword [esi + 0x40], edi
shr eax, 0x10
test ax, ax
jne 0x440d66
cmp dword [esi + 0x3c], 0
jne 0x440d66
movzx eax, di
mov dword [esi + 0x3c], eax
call fcn.004500ae
mov ebx, dword [eax + 0xc]
push 5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
mov ecx, esi
push dword [esp + 0x18]
push eax
call fcn.00440d93
pop edi
pop esi
pop ebx
ret 8

Function at 0x44110f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 4
push ebx
push esi
mov eax, dword [ecx + 0x48]
push edi
mov edi, dword [ecx + 0x44]
push ebp
mov esi, ecx
mov dword [esp + 0x10], eax
call fcn.004500ae
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x44114e
call fcn.004500ae
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44115d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x44116e
mov eax, 0xffffffff
jmp 0x441228
mov ecx, esi
xor ebp, ebp
call fcn.0044109a
mov edi, eax
call fcn.00442025
push edi
call fcn.004419f2
test edi, edi
je 0x4411a0
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4411a0
push ebp
push edi
mov ebp, 1
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call fcn.00441fe0
push ebx
push edi
call fcn.004419f2
push eax
mov ecx, esi
push dword [esp + 0x18]
call fcn.00440df7
test eax, eax
je 0x4411f4
test byte [esi + 0x24], 0x10
je 0x4411e1
mov ebx, 4
mov ecx, esi
call fcn.004446df
test ah, 1
je 0x4411d9
mov ebx, 5
push ebx
mov ecx, esi
call fcn.00444323
push 0x97
xor eax, eax
push eax
mov ecx, esi
push eax
push eax
push eax
push eax
call fcn.0044478d
test ebp, ebp
je 0x441201
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
test edi, edi
je 0x441217
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x441217
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x5c]
mov ecx, esi
call fcn.004410d0
mov eax, dword [esi + 0x2c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x441408
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov esi, dword [ecx + 0x48]
mov eax, dword [ecx + 0x44]
mov edi, ecx
cmp dword [ecx + 0x40], 0
je 0x441435
call fcn.004500ae
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x441442
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, 1
test esi, esi
je 0x441482
cmp word [esi + 2], 0xffff
mov eax, dword [esi]
jne 0x441462
mov cx, word [esi + 0x12]
mov eax, dword [esi + 0xc]
mov dx, word [esi + 0x14]
jmp 0x44146a
mov cx, word [esi + 0xa]
mov dx, word [esi + 0xc]
test eax, 0x1801
jne 0x441480
test cx, cx
jne 0x441480
test dx, dx
mov eax, 1
je 0x441482
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x4441fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov edi, ecx
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x44423c
call fcn.004500ae
mov ebp, dword [eax + 0xc]
push 0xf0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x44423c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x444233
xor eax, eax
jmp 0x444244
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0044424b
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4462f9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, dword [esp + 0xc]
mov ebp, esp
sub esp, 4
test eax, eax
push esi
jne 0x44630c
xor eax, eax
jmp 0x446334
push 0
lea edx, [ebp - 4]
push edx
push eax
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x446331
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00445949
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44633b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push esi
push edi
mov edi, ecx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x446383
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x446372
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00445949
cmp dword [ebp - 4], esi
je 0x446383
push dword [edi + 0xc]
push 0xffffffffffffffff
push 0xd
call fcn.00445a24
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x447840
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
cmp dword [eax + 4], 0x100
jne 0x447885
cmp dword [eax + 8], 0x70
jne 0x447885
mov eax, dword [eax + 0xc]
shr eax, 0x10
test ah, 0x40
jne 0x447885
push 0x10
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
test ax, ax
jl 0x447885
push 0x11
call esi
test ax, ax
jl 0x447885
push 0x12
call esi
test ax, ax
mov eax, 1
jge 0x447887
xor eax, eax
pop esi
ret 4

Function at 0x449e17
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [ecx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
test al, 1
je 0x449e3d
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x9c]
test eax, eax
jne 0x449e53
xor eax, eax
jmp 0x449e58
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0x20]
call dword [eax + 0x9c]
test eax, eax
mov eax, 0
je 0x449e58
mov eax, 1
pop esi
ret
Function at 0x44a2e6
Capabilities:
Get common file path
Get disk size
Timestomp file

Disassembly:
mov eax, 0x44a49d
call fcn.0043147c
sub esp, 0x248
mov dword [ebp - 0x14], ecx
add ecx, 0x10
push esi
mov dword [ebp - 0x18], ecx
call fcn.00444f83
test byte [ebp + 0xd], 0x10
je 0x44a3ca
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 8]
call fcn.00446f2f
test eax, eax
je 0x44a3ca
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.00444ea3
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
call fcn.00446a51
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x34]
push eax
lea edx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x24]
push edx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x44a367
mov esi, dword [ebp - 0x34]
imul esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x144]
add eax, eax
cmp eax, esi
jge 0x44a3be
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x254]
push eax
push ecx
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ecx, dword [ebp - 0x1c]
push 0x105
mov byte [ecx], 0
mov ecx, dword [ebp - 0x18]
call fcn.00445385
push eax
lea ecx, [ebp - 0x254]
push 0
push 0x456ff8
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
call fcn.004453da
mov dword [ebp - 4], 0xffffffff
call fcn.0044a4a7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
cmp dword [ecx - 8], 0
je 0x44a4af
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004461b7
test eax, eax
je 0x44a4af
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.0044514b
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
push eax
lea edx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x14]
push edx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x44a445
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x150]
push eax
push ecx
call fcn.00446fe9
add esp, 8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
push ecx
push edx
push eax
mov ecx, dword [ebp - 0x14]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 0x10], eax
push eax
push eax
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
push dword [ebp - 0x10]
call fcn.00440b11
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x10]
push esi
push 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
test eax, eax
je 0x44a48d
push esi
mov eax, dword [ebp - 0x18]
push 4
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
push esi
call fcn.00440b51
add esp, 4
mov eax, 1
jmp 0x44a4c8
mov ecx, dword [ebp - 0x18]
call fcn.00444f83
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
call fcn.004461b7
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44b936
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov eax, 0x100
cmp edi, eax
ja 0x44b97d
push eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, edi
jne 0x44b97d
push esi
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x44b987
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x44d1aa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
cmp dword [ecx + 0x74], 0
mov esi, ecx
je 0x44d1f2
push dword [ebp + 8]
call fcn.004525eb
mov esi, eax
test esi, esi
jne 0x44d1cc
xor eax, eax
jmp 0x44d21d
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
sbb eax, eax
neg eax
jmp 0x44d21d
push dword [ebp + 0x10]
push 0x456850
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x10]
push dword [esi + 0x88]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44d873
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push ebp
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x44d909
mov ebp, 0x18000000
push edi
call fcn.00441a1c
mov ebx, eax
test ebx, ebx
je 0x44d8fa
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x44d8fa
push edi
push eax
call fcn.0044d6c7
test eax, eax
je 0x44d8fa
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp dword [esp + 0x14], 0
jne 0x44d8e3
mov ecx, eax
and ecx, ebp
cmp ecx, 0x10000000
jne 0x44d8dc
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
or byte [ebx + 0x24], 2
jmp 0x44d8fa
cmp dword [esp + 0x14], 0
je 0x44d8fa
test ebp, eax
jne 0x44d8fa
test byte [ebx + 0x24], 2
je 0x44d8fa
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [ebx + 0x24], 0xfd
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x44d893
pop ebp
pop edi
pop esi
pop ebx
ret 4