joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433470
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4a6c10]
push esi
push edi
mov ecx, ebp
call fcn.00412600
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x13c]
call fcn.004412a0
mov esi, eax
test esi, esi
je 0x433550
push 0
push esi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
test edi, edi
je 0x4334ea
cmp edi, dword [0x4a8c80]
je 0x4334ea
call fcn.004734f0
test al, al
jne 0x4334ea
mov ecx, dword [0x4a8c80]
push 1
push edi
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x1c], eax
test bl, bl
je 0x43350c
mov edx, dword [0x4a8c80]
push 0
push edi
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x433550
lea ecx, [esp + 0x20]
push 0xfc
mov edx, ecx
push edx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x433550
lea eax, [esp + 0x10]
push eax
push 0x433600
push esi
mov dword [esp + 0x24], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp byte [esp + 0x14], 0
jne 0x4335a8
mov ecx, dword [0x4a3440]
cmp byte [ecx + 0xe4], 0
jne 0x433583
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push edx
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov ecx, dword [esp + 0x12c]
push 0x4957f9
push 0
push 0x496ed0
call fcn.0042cd10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
mov eax, dword [esp + 0x18]
push eax
push 0x495840
mov eax, 0x101
lea ecx, [esp + 0x28]
call fcn.0046eb00
mov ecx, dword [0x4a7474]
add esp, 8
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push ecx
call fcn.004715e0
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x2c]
push edx
push ebp
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 0x14
Function at 0x433680
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.004412a0
mov edi, eax
test edi, edi
je 0x4336ae
mov esi, dword [esp + 0x1c]
push edi
call fcn.00473000
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4336f9
mov ecx, dword [0x4a3440]
cmp byte [ecx + 0xe4], 0
jne 0x4336dc
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push edx
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x4957f9
push 0
push 0x496ed0
call fcn.0042cd10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x433731
cmp ebp, dword [0x4a8c80]
je 0x433731
mov esi, edi
call fcn.004734f0
test al, al
jne 0x433731
mov eax, dword [0x4a8c80]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x43376f
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push edx
call fcn.004715e0
mov eax, dword [0x4a3440]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x43376f
push 1
push eax
call fcn.00401280
add esp, 8
test bl, bl
je 0x433783
mov ecx, dword [0x4a8c80]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4345b0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.0042f040
mov ebx, eax
test ebx, ebx
jne 0x4345e3
mov ecx, dword [ebp + 8]
push esi
push eax
push str.Parameter_1_invalid.
call fcn.0042cfd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x4345ef
jmp dword [eax*4 + 0x4347e8]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x434609
push eax
call fcn.00450f50
add esp, 4
jmp 0x43460f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4a7474]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00450f50
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x434687
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x434687
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4a7474]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push ecx
call fcn.004715e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx edx, byte [edi]
push edx
call fcn.00483d73
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x4346c2.67
movzx eax, byte [eax + 0x434818]
jmp dword [eax*4 + 0x4347fc]
mov esi, 0x40
jmp 0x4346f1
mov esi, 0x4000
jmp 0x4346f1
mov esi, 0x20
jmp 0x4346f1
mov esi, 0x8000
jmp 0x4346f1
mov esi, 0x80
jmp 0x4346f1
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x434704
push eax
call fcn.00450f50
add esp, 4
jmp 0x43470a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x434687
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x434687
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x43465b
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push edx
call fcn.004715e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [edi], 0
je 0x434783
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.004125c0
fmul qword [0x49d6b0]
call fcn.0048fec0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x434790
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00450f50
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x4347ad
test esi, esi
jne 0x43466a
jmp 0x4347b1
test esi, esi
je case.0x4346c2.67
cmp byte [esp + 0x13], 0
jne 0x4347cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x43466a
push 1
push 0x64
call fcn.00401280
add esp, 8
jmp 0x434790
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x435080
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a6c10]
push eax
mov eax, dword [esp + 0x18]
call fcn.004412a0
mov ebp, eax
test ebp, ebp
je 0x4350a6
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x4350ab
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.004715e0
cmp eax, 1
je 0x4350c9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x4351d2
cmp byte [edi + 0x17], 0
jne 0x4350dc
mov esi, dword [edi + 0xc]
jmp 0x4350de
mov esi, edi
test byte [esi + 0x15], 8
je 0x4350eb
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435104
test byte [esi + 0x15], 4
je 0x4350ff
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
jmp 0x435114
cmp al, 2
jne 0x43510f
call fcn.00401000
jmp 0x435114
mov eax, 0x4a857d
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x43512a
mov esi, dword [edi + 0xc]
jmp 0x43512c
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435144
test byte [esi + 0x15], 8
je 0x43513f
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435149
mov eax, 0x4a9514
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x435156
mov esi, dword [edi + 0xc]
jmp 0x435158
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x435170
test byte [esi + 0x15], 8
je 0x43516b
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435175
mov eax, 0x4a9514
cmp dword [eax], 0
jne 0x435248
cmp byte [edi + 0x17], 0
jne 0x435189
mov esi, dword [edi + 0xc]
jmp 0x43518b
mov esi, edi
test byte [esi + 0x15], 8
je 0x435198
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x4351b7
test byte [esi + 0x15], 4
je 0x4351ac
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x435248
cmp al, 2
jne 0x4351c8
call fcn.00401000
mov byte [eax], 0
jmp 0x435248
mov eax, 0x4a857d
mov byte [eax], 0
jmp 0x435248
cmp byte [edi + 0x17], 0
jne 0x4351dd
mov esi, dword [edi + 0xc]
jmp 0x4351df
mov esi, edi
test byte [esi + 0x15], 8
je 0x4351ec
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x435205
test byte [esi + 0x15], 4
je 0x435200
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
jmp 0x435215
cmp al, 2
jne 0x435210
call fcn.00401000
jmp 0x435215
mov eax, 0x4a857d
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435223
mov esi, dword [edi + 0xc]
jmp 0x435225
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x43523d
test byte [esi + 0x15], 8
je 0x435238
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x435242
mov eax, 0x4a9514
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x435251
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x435276
cmp dword [0x4a8cd0], 0
je 0x435276
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4a8cc4
jmp fcn.00403f00
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x4360a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.0048dcd0
push ebp
mov ebp, dword [0x4a6c10]
push esi
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 0x7fff
jb 0x4361ca
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push ebp
call fcn.004715e0
test eax, eax
jne 0x4360f0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
cmp byte [ebp + 0x17], 0
jne 0x4360fb
mov esi, dword [ebp + 0xc]
jmp 0x4360fd
mov esi, ebp
test byte [esi + 0x15], 8
je 0x43610a
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436123
test byte [esi + 0x15], 4
je 0x43611e
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
jmp 0x436133
cmp al, 2
jne 0x43612e
call fcn.00401000
jmp 0x436133
mov eax, 0x4a857d
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x436185
cmp byte [ebp + 0x17], al
jne 0x43614a
mov esi, dword [ebp + 0xc]
jmp 0x43614c
mov esi, ebp
test byte [esi + 0x15], 8
je 0x436159
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436172
test byte [esi + 0x15], 4
je 0x43616d
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
jmp 0x436182
cmp al, 2
jne 0x43617d
call fcn.00401000
jmp 0x436182
mov eax, 0x4a857d
mov byte [eax], 0
cmp byte [ebp + 0x17], 0
jne 0x436190
mov eax, dword [ebp + 0xc]
jmp 0x436192
mov eax, ebp
cmp byte [eax + 0x17], 2
jne 0x4361b7
cmp dword [0x4a8cd0], 0
je 0x4361b7
push 1
mov ecx, 0x4a8cc4
call fcn.00403f00
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
and byte [eax + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x4361d7
mov eax, 0x4957f9
push 1
push 0
push edi
push eax
push ebp
call fcn.004715e0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
Function at 0x4389e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
xor ebx, ebx
xor edi, edi
lea eax, [esp + 0x14]
push eax
mov ecx, edi
or ecx, 1
push ecx
push ebx
push str.SOFTWAREAutoHotkey
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
je 0x438a18
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x438a93
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push str.InstallDir
push ecx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x438a10
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x438a10
dec eax
mov dword [esp + 0x10], eax
cmp byte [esp + eax + 0x18], bl
jne 0x438a77
cmp eax, ebx
je 0x438a93
lea ecx, [esp + 0x18]
cmp byte [ecx + eax - 1], bl
jne 0x438a71
dec eax
jne 0x438a68
mov dword [esp + 0x10], eax
jmp 0x438a8f
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x104
jb 0x438a8b
mov byte [esp + 0x18], bl
xor eax, eax
jmp 0x438a93
mov byte [esp + eax + 0x18], bl
cmp eax, ebx
jne 0x438aa1
cmp edi, ebx
jne 0x438aa1
mov edi, 0x100
jmp 0x4389f4
mov esi, dword [esp + 0x120]
cmp esi, ebx
je 0x438abe
lea ecx, [esp + 0x18]
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x438ab4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x43c010
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [0x4a6c10]
push esi
push edi
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov cl, byte [edi]
test cl, cl
je 0x43c0fe
cmp byte [edi + 1], 0
jne 0x43c07a
mov byte [esp + 0x14], cl
cmp cl, 0xa
jne 0x43c04a
mov al, 0xd
jmp 0x43c0ef
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ecx, ax
mov eax, ecx
shr eax, 8
cmp al, 0xff
jne 0x43c06e
cmp cl, 0xff
jne 0x43c06e
xor al, al
jmp 0x43c0ef
and al, 0x38
neg al
sbb al, al
not al
and al, cl
jmp 0x43c0ef
movzx esi, cl
test esi, 0xffffff80
jne 0x43c097
push 2
push esi
call fcn.00482bae
add esp, 8
test eax, eax
je 0x43c097
and esi, 0xffffffdf
mov eax, esi
cmp al, 0x56
jne 0x43c0bb
mov al, byte [edi + 1]
call fcn.00408ef0
cmp al, 0x4b
jne 0x43c0bb
push 0x10
lea eax, [edi + 2]
push 0
push eax
call fcn.00482ff4
add esp, 0xc
jmp 0x43c0ef
xor esi, esi
lea ecx, [ecx]
mov eax, dword [esi*8 + 0x4a4160]
push edi
push eax
call fcn.00481691
add esp, 8
test eax, eax
je 0x43c131
inc esi
cmp esi, 0x6d
jl 0x43c0c0
mov eax, edi
call fcn.004116f0
movzx ecx, ax
test cx, cx
je 0x43c0fe
call fcn.00411e50
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
jne 0x43c17b
push 0
lea ebx, [esp + 0x18]
mov eax, edi
call fcn.0044c2b0
mov edi, eax
add esp, 4
test edi, edi
jne 0x43c13e
push 1
push eax
push 0xffffffffffffffff
push 0x4957f9
push ebp
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov cl, byte [esi*8 + 0x4a4164]
mov byte [esp + 0x13], cl
jmp 0x43c0f3
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], edx
call fcn.0044c550
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.00470fe0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
mov ecx, dword [esp + 0x12c]
movzx ebx, byte [ecx]
test ebx, 0xffffff80
jne 0x43c19f
push 2
push ebx
call fcn.00482bae
add esp, 8
test eax, eax
je 0x43c19f
and bl, 0xdf
cmp bl, 0x50
je 0x43c1b2
xor eax, eax
cmp bl, 0x54
setne al
dec eax
and eax, 2
jmp 0x43c1b7
mov eax, 1
mov bl, byte [esp + 0x13]
push eax
call fcn.0044c4a0
add esp, 4
test al, al
mov eax, 0x49a988
jne 0x43c1d2
mov eax, 0x49a98c
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
Function at 0x43c1f0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
push esi
mov esi, ecx
mov ecx, dword [0x4a6c10]
push edi
call fcn.00412600
test esi, esi
je 0x43c366
cmp byte [esi], 0
je 0x43c366
push 0x104
lea eax, [esp + 0x34]
push esi
push eax
call fcn.004844d0
lea eax, [esp + 0x3c]
add esp, 0xc
mov byte [esp + 0x134], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43c240
sub eax, edx
cmp byte [esp + eax + 0x2f], 0x5c
je 0x43c269
lea ecx, [eax + 1]
cmp ecx, 0x105
jae 0x43c366
mov byte [esp + eax + 0x30], 0x5c
mov byte [esp + eax + 0x31], 0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [0x4a9f08], 1
jne 0x43c29f
or dword [0x4a9f08], 1
push str.GetDiskFreeSpaceExA
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a9f04], eax
jmp 0x43c2a4
mov eax, dword [0x4a9f04]
test eax, eax
je 0x43c2f2
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push ecx
call eax
test eax, eax
je 0x43c366
cmp byte [ebp + 0xc], 0
je 0x43c2df
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43c334
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
shrd esi, eax, 0x14
shr eax, 0x14
mov edi, eax
jmp 0x43c334
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x43c366
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x14]
jne 0x43c323
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 8]
shr eax, 0x14
mov esi, eax
xor edi, edi
mov ecx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push ecx
call fcn.004715e0
mov eax, dword [0x4a6c10]
push 0x18
push edi
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x4a3440]
cmp byte [edx + 0xe4], 0
jne 0x43c393
mov eax, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push eax
call fcn.004715e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x4957f9
push 0
push 0x496ed0
call fcn.0042cd10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43e150
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call ebx
test eax, eax
jne 0x43e17d
cmp byte [0x4a92b8], al
je 0x43e224
call fcn.00408fa0
pop ebx
add esp, 0x10c
ret
cmp byte [0x4a92b8], 0
push ebp
push esi
mov esi, 0x4a7478
jne 0x43e191
lea esi, [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0x104
call ebp
test eax, eax
je 0x43e1ec
cmp byte [edi], 0
je 0x43e202
cmp byte [edi + 1], 0x3a
jne 0x43e202
cmp byte [edi + 2], 0
jne 0x43e202
push esi
push edi
call fcn.00481691
add esp, 8
test eax, eax
je 0x43e202
push edi
lea eax, [esp + 0x10]
push 0x49abf8
push eax
call fcn.00481bc8
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call ebx
test eax, eax
je 0x43e202
push esi
push 0x104
call ebp
test eax, eax
jne 0x43e202
push 0x103
push edi
push esi
call fcn.004844d0
mov byte [esi + 0x103], 0
add esp, 0xc
cmp byte [0x4a92b8], 0
pop esi
pop ebp
je 0x43e224
mov edx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x495870
push edx
call fcn.004715e0
pop ebx
add esp, 0x10c
ret
Function at 0x43e820
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x124]
mov ebp, ecx
test edi, edi
je 0x43e9a2
cmp byte [edi], 0
je 0x43e9a2
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43e87b
mov ecx, dword [0x4a3440]
shr eax, 4
not al
and al, 1
movzx edx, al
push edx
push ebp
mov dword [ecx + 0x30], 0xb7
call fcn.0042ce00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0x5c
push edi
call fcn.0048357e
mov ebx, eax
add esp, 8
cmp ebx, edi
jbe 0x43e969
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e895
sub eax, edx
cmp eax, 0x104
jb 0x43e8e3
mov eax, dword [0x4a3440]
mov dword [eax + 0x30], 0x6f
cmp byte [eax + 0xe4], cl
jne 0x43e8dc
mov eax, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push eax
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov ecx, ebp
jmp 0x43e9bb
mov esi, ebx
sub esi, edi
push esi
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.004844d0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
mov byte [esp + esi + 0x1c], 0
call fcn.0043e820
cmp byte [ebx + 1], 0
je 0x43e957
mov esi, dword [0x4a7474]
cmp byte [esi + 0x17], 0
jne 0x43e91c
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x43e929
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x43e942
test byte [esi + 0x15], 4
je 0x43e93d
mov eax, esi
call fcn.0042d7f0
mov eax, dword [esi + 8]
jmp 0x43e952
cmp al, 2
jne 0x43e94d
call fcn.00401000
jmp 0x43e952
mov eax, 0x4a857d
cmp byte [eax], 0x31
jne 0x43e969
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
sete al
mov byte [esp + 0x14], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4a3440]
push edx
push ebp
mov dword [ecx + 0x30], eax
call fcn.0042ce00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, dword [0x4a3440]
cmp byte [eax + 0xe4], 0
mov dword [eax + 0x30], 0x57
je 0x43e8b9
push 0x4957f9
push 0
push 0x496ed0
call fcn.0042cd10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
Function at 0x43ffd0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
mov ebx, edx
call fcn.0040c8e0
test al, al
je 0x43fff8
push 0x10
push 0
push edi
call fcn.00482ff4
add esp, 0xc
jmp 0x440001
push edi
call fcn.00482bf6
add esp, 4
cmp eax, 1
je 0x440066
call fcn.00450bd0
test al, al
je 0x440066
mov eax, dword [0x4a3440]
cmp byte [eax + 0xe4], 0
jne 0x440041
mov ecx, dword [0x4a7474]
push 1
push 0
push 0xffffffffffffffff
push 0x496ed0
push ecx
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov ecx, dword [esp + 0x124]
push 0x4957f9
push 0
push 0x496ed0
call fcn.0042cd10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4400b4
mov edx, dword [0x4a3440]
cmp byte [edx + 0xe4], 0
jne 0x440041
push 1
push 0
push eax
mov eax, dword [0x4a7474]
push 0x496ed0
push eax
call fcn.004715e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4400c0
sub eax, edx
cmp eax, 0x104
jb 0x4400d5
mov eax, 0x103
inc eax
push eax
lea ecx, [esp + 0x1c]
push ebx
push ecx
call fcn.00489e00
lea edx, [esp + 0x24]
add esp, 0xc
push edx
call fcn.00483e8c
add esp, 4
push 0xa
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x440141
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x440141
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x440141
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
jmp 0x440143
xor bl, bl
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
test bl, bl
sete dl
movzx eax, dl
push eax
push ecx
call fcn.0042ce00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4