joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437fae
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
je 0x437fbc
xor eax, eax
jmp 0x437fc1
mov eax, 1
push eax
push dword [ebp + 8]
call fcn.00437a10
pop ecx
push eax
call fcn.004e3edc
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.00439761
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4384db
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0046c854
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00437a10
pop ecx
push eax
call fcn.004e3e64
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
test ebx, ebx
je 0x438519
mov ax, word [ebp - 4]
jmp 0x43851b
xor eax, eax
mov ebx, eax
cmp bx, 0xffff
jne 0x438526
xor ebx, ebx
call fcn.0046c84f
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x438531
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.0046c854
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x43856a
push 0
lea edx, [ebp - 4]
push edx
movzx ecx, si
push ecx
push dword [ebp + 0xc]
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3f2a
mov ebx, eax
jmp 0x43857e
xor eax, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3e94
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
test ebx, ebx
je 0x438593
mov dx, word [ebp - 4]
jmp 0x438595
xor edx, edx
mov ebx, edx
call fcn.0046c84f
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4385a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0046c854
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00437a10
pop ecx
push eax
call fcn.004e3e64
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x4385dd
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0046c854
test esi, esi
je 0x43861b
push 0
push 0
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3f2a
push eax
call fcn.00439761
add esp, 8
jmp 0x438633
push 0
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3e94
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x438640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c6f66
test eax, eax
je 0x4386ad
call fcn.0046c854
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d91b8
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3e64
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
jmp 0x4386e7
call fcn.0046c854
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00438b55
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x4386dd
cmp eax, dword [ebp + 0x14]
jne 0x4386dd
push edi
push esi
push ebx
call fcn.004385a3
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x4386e2
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046c84f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4386f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004c6f66
test eax, eax
je 0x43875e
call fcn.0046c854
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004d91b8
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00437a10
pop ecx
push eax
call fcn.004e3f2a
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
jmp 0x438798
call fcn.0046c854
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00438b55
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x43878e
cmp eax, dword [ebp + 0x14]
jne 0x43878e
push edi
push esi
push ebx
call fcn.004385dd
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x438793
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046c84f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438c72
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439414
add esp, 8
mov ebx, eax
call fcn.0046c854
push ebx
call fcn.004e3c3c
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
call fcn.0046c84f
cmp dword [ebp - 4], 0
je 0x438cb5
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x438cbb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439414
add esp, 8
mov ebx, eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.00439414
add esp, 8
mov esi, eax
call fcn.0046c854
push esi
push ebx
call fcn.004e3e3a
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
call fcn.0046c84f
cmp dword [ebp - 4], 0
je 0x438d14
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
cmp dword [ebp - 8], 0
je 0x438d23
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x438d2b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439414
add esp, 8
mov ebx, eax
call fcn.0046c854
push 0
push ebx
call fcn.004e3c1e
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
call fcn.0046c84f
cmp dword [ebp - 4], 0
je 0x438d70
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x438d76
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439414
add esp, 8
mov ebx, eax
call fcn.0046c854
push ebx
call fcn.004e3e8e
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
call fcn.0046c84f
cmp dword [ebp - 4], 0
je 0x438db9
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x438dbf
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439414
add esp, 8
mov ebx, eax
call fcn.0046c854
push ebx
call fcn.004e3e70
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
call fcn.0046c84f
cmp dword [ebp - 4], 0
je 0x438e02
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x438e29
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov word [ebp - 2], di
mov byte [ebx], 0
test di, di
je 0x438e66
call fcn.00438fa6
and eax, 0xff
inc eax
mov word [ebp - 2], ax
cmp di, word [ebp - 2]
je 0x438e66
mov edx, edi
add dl, 0xff
push edx
call fcn.00438f25
pop ecx
call fcn.0046c854
push ebx
push esi
call fcn.004e3cb4
push 0
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
call fcn.0043971e
mov word [ebp - 4], ax
cmp di, word [ebp - 2]
je 0x438ea9
mov cl, byte [ebp - 2]
add cl, 0xff
push ecx
call fcn.00438f25
pop ecx
mov ax, word [ebp - 4]
push eax
call fcn.0043974b
pop ecx
mov byte [ebx + esi - 1], 0
cmp word [ebp - 4], 0
jne 0x438f1b
cmp byte [ebx], 0
je 0x438f1b
mov edi, ebx
push ebx
call fcn.004d9368
pop ecx
mov esi, eax
cmp byte [edi + 1], 0x3a
jne 0x438ed1
add edi, 2
sub esi, 2
movsx eax, byte [edi]
push eax
push 0x6f3abe
call fcn.004d9298
add esp, 8
test eax, eax
je 0x438ee8
inc edi
dec esi
test esi, esi
je 0x438f04
movsx edx, byte [edi + esi - 1]
push edx
push 0x6f3abe
call fcn.004d9298
add esp, 8
test eax, eax
je 0x438f04
dec esi
test esi, esi
je 0x438f17
cmp edi, ebx
je 0x438f17
push esi
push edi
push ebx
call fcn.004d916c
add esp, 0xc
mov byte [ebx + esi], 0
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x438fdb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov al, byte [ebp + 8]
add al, 0x41
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
call fcn.0046c854
lea edx, [ebp - 4]
push edx
call fcn.004e3ccc
mov ebx, eax
call fcn.0046c84f
test ebx, ebx
je 0x439012
cmp ebx, 1
jne 0x439018
mov ax, 0xffff
jmp 0x43901a
xor eax, eax
mov ebx, eax
push 0
call fcn.0043974b
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x439380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0
push ebx
push esi
call fcn.004e3cb4
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00439761
add esp, 8
call fcn.0046c84f
call fcn.0043971e
test ax, ax
je 0x4393be
call fcn.0043971e
jmp 0x439410
mov eax, ebx
cmp byte [eax + 1], 0x3a
jne 0x4393c9
add eax, 2
cmp eax, ebx
je 0x4393d8
push esi
push eax
push ebx
call fcn.004d916c
add esp, 0xc
push ebx
call fcn.004d9368
pop ecx
mov esi, eax
movsx eax, byte [ebx + esi - 1]
push eax
push 0x6f3abe
call fcn.004d9298
add esp, 8
test eax, eax
je 0x4393fe
mov byte [ebx + esi], 0
jmp 0x43940e
push 0
push 0x6f3ac2
push ebx
call fcn.004c4244
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x43a1e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0x63
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x43a21f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x43a21f
push 0x107
push dword [ebp + 8]
push ebx
call fcn.004c4bc0
add esp, 0xc
jmp 0x43a235
push ebx
push 0x107
call fcn.004e3d6e
test eax, eax
jne 0x43a235
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
cmp byte [ebx], 0
je 0x43a251
push ebx
call fcn.004d9368
pop ecx
cmp byte [ebx + eax - 1], 0x5c
je 0x43a251
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
cmp dword [ebp + 0xc], 0
je 0x43a268
push 0x107
push dword [ebp + 0xc]
push ebx
call fcn.004c4bfb
add esp, 0xc
push ebx
call fcn.004d9368
pop ecx
mov edi, eax
cmp edi, 0x101
jle 0x43a281
or eax, 0xffffffff
jmp 0x43a31d
call fcn.004408bb
fstp qword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 8], edx
fld qword [ebp - 0x10]
fmul dword [0x43a324]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.004dda50
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004dde6c
add esp, 0xc
fstp qword [ebp - 0x10]
mov ecx, esi
cmp esi, 9
jle 0x43a2c4
mov al, 0x57
jmp 0x43a2c6
mov al, 0x30
add cl, al
mov byte [ebx + edi], cl
inc edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jl 0x43a28e
mov byte [ebx + edi], 0
cmp dword [ebp + 0x18], 0
je 0x43a2f0
push 0x107
push dword [ebp + 0x18]
push ebx
call fcn.004c4bfb
add esp, 0xc
push 0
push ebx
call fcn.00439414
add esp, 8
push 0x410
push dword [ebp + 0x10]
push ebx
call fcn.004380f3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43a31d
dec dword [ebp - 4]
jne 0x43a1fb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a328
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43a358
cmp byte [eax], 0
je 0x43a358
push 0x107
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004c4bc0
add esp, 0xc
jmp 0x43a37d
lea edx, [ebp - 0x108]
push edx
push 0x108
call fcn.004e3d6e
test eax, eax
jne 0x43a37d
push 0
push 0
call fcn.00439761
add esp, 8
xor eax, eax
jmp 0x43a3ab
mov byte [ebp - 1], 0
push dword [ebp + 8]
push 0
test ebx, ebx
jne 0x43a38f
mov ebx, 0x6f3b58
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.004e3d68
mov ebx, eax
push 0
push ebx
call fcn.00439761
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bf44
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x6f3c0c]
mov dword [ebp - 8], eax
mov eax, dword [0x6f3c10]
mov dword [ebp - 4], eax
push 7
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov ebx, eax
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004c4289
add esp, 0xc
push 0
push 0x6f3c18
push ebx
call fcn.004c4244
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push ebx
call fcn.004e3c6c
mov esi, eax
cmp esi, 0xffffffff
je 0x43bfe6
test byte [ebp - 0x148], 0x10
je 0x43bfcf
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 8]
push edx
call fcn.004e3c18
dec eax
jne 0x43bfcf
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x148]
push eax
push esi
call fcn.004e3c72
test eax, eax
jne 0x43bfa1
push esi
call fcn.004e3c66
push ebx
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c48a
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x140
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
xor eax, eax
mov dword [edi + 0x13c], eax
push 0x258
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [edi + 0x13c], eax
mov ebx, dword [edi + 0x13c]
cmp dword [ebp + 0xc], 8
jne 0x43c54a
mov eax, dword [0x6f3c14]
mov dword [ebp - 8], eax
push 3
push dword [ebp + 8]
lea edx, [ebp - 8]
push edx
call fcn.004c4bc0
add esp, 0xc
mov dword [ebx], 0xffffffff
cmp byte [ebp - 6], 0
jne 0x43c4f2
mov byte [ebp - 6], 0x5c
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x104
lea eax, [ebx + 0x14c]
push eax
lea edx, [ebp - 8]
push edx
call fcn.004e3d98
test eax, eax
je 0x43c543
lea ecx, [ebp - 8]
push ecx
lea eax, [ebx + 0x250]
push eax
call fcn.0043bf44
add esp, 8
mov esi, 1
push dword [ebp + 0xc]
call fcn.0043c099
pop ecx
mov dword [ebx + 0x144], eax
jmp 0x43c64b
xor esi, esi
jmp 0x43c64b
push dword [ebp + 8]
call fcn.004d9368
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebx], 0xffffffff
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x43c64b
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004c4289
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp byte [eax + edx - 1], 0x5c
jne 0x43c5a7
push 0
push 0x6f3c18
push dword [ebp - 0xc]
call fcn.004c4244
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push dword [ebp - 0xc]
call fcn.004e3c6c
mov dword [ebx], eax
push dword [ebp + 0xc]
call fcn.0043c099
pop ecx
mov dword [ebx + 0x144], eax
cmp dword [ebx], 0xffffffff
je 0x43c642
cmp dword [ebx + 0x144], 0
je 0x43c5e9
cmp dword [ebx + 4], 0
je 0x43c5e9
test byte [ebx + 4], 0x80
jne 0x43c5e9
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43c5f0
mov esi, 1
jmp 0x43c642
test byte [ebx + 4], 0x10
jne 0x43c601
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43c608
mov esi, 1
jmp 0x43c642
xor esi, esi
jmp 0x43c633
cmp dword [ebx + 0x144], 0
je 0x43c62c
cmp dword [ebx + 4], 0
je 0x43c62c
test byte [ebx + 4], 0x80
jne 0x43c62c
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43c633
mov esi, 1
jmp 0x43c642
lea eax, [ebx + 4]
push eax
push dword [ebx]
call fcn.004e3c72
test eax, eax
jne 0x43c60c
push dword [ebp - 0xc]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push 0
push esi
call fcn.00439761
add esp, 8
test esi, esi
je 0x43c663
push edi
call fcn.0043c2d7
pop ecx
jmp 0x43c66c
push edi
call fcn.0043c6e9
pop ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440b54
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0x8007
call fcn.004e3e9a
mov dword [0x6f3ef8], eax
push 0x440ac1
call fcn.004e3ec4
call fcn.004e3cc0
push eax
push 0
push 0x440adb
push 3
call fcn.004e4750
mov dword [0x6f3ef4], eax
push 1
push 0x440b39
call fcn.004e3e82
pop ebp
ret
Function at 0x44e65d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call fcn.004e3d92
cmp dword [ebp - 0x98], 2
jne 0x44e6cb
cmp dword [ebp - 0xa4], 5
jb 0x44e6cb
push str.winspool.drv
call fcn.004e3e10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44e6cb
push str.GetDefaultPrinterA
push dword [ebp - 4]
call fcn.004e3d2c
test eax, eax
je 0x44e6c3
push edi
push ebx
call eax
mov esi, eax
push dword [ebp - 4]
call fcn.004e3c90
test esi, esi
jne 0x44e710
push dword [edi]
push ebx
push 0x6f47b8
push str.device
push str.windows
call fcn.004e3d44
test eax, eax
je 0x44e70d
cmp eax, dword [edi]
jae 0x44e70d
xor eax, eax
jmp 0x44e6f3
inc eax
cmp byte [ebx + eax], 0
je 0x44e6ff
cmp byte [ebx + eax], 0x2c
jne 0x44e6f2
mov byte [ebx + eax], 0
inc eax
mov dword [edi], eax
mov esi, 1
jmp 0x44e710
inc eax
mov dword [edi], eax
test esi, esi
jne 0x44e7b6
cmp dword [ebp - 0x98], 1
jne 0x44e7b6
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 2
push 0
push 1
call fcn.004e4078
test eax, eax
je 0x44e7b6
cmp dword [ebp - 8], 0
jbe 0x44e7b6
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44e7b6
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
push dword [ebp - 8]
push dword [ebp - 0x10]
push 2
push 0
push 1
call fcn.004e4078
test eax, eax
je 0x44e7ad
cmp dword [ebp - 0xc], 0
jbe 0x44e7ad
mov ecx, dword [ebp - 0x10]
push dword [ecx + 4]
call fcn.004e3f7e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44e7ad
mov eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jbe 0x44e7ad
mov edx, dword [ebp - 0x10]
push dword [edx + 4]
push ebx
call fcn.004e3f72
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [edi], ecx
mov esi, 1
push dword [ebp - 0x10]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ed07
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44ed10
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.004e4084
test eax, eax
je 0x44ee21
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x8018], edx
xor ecx, ecx
mov dword [ebp - 0x8014], ecx
mov dword [ebp - 0x8010], 0x6f482a
lea eax, [ebp - 0x8018]
push eax
push 1
push dword [ebp - 4]
call fcn.004e4090
test eax, eax
je 0x44ee12
push dword [ebp - 4]
call fcn.004e4096
test eax, eax
je 0x44ee03
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 0xc]
call fcn.004e3c24
mov esi, eax
cmp esi, 0xffffffff
je 0x44edf4
jmp 0x44edc5
mov eax, dword [ebp - 8]
cmp byte [ebp + eax - 0x800d], 0x1a
jne 0x44edaf
dec dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push dword [ebp - 8]
lea ecx, [ebp - 0x800c]
push ecx
push dword [ebp - 4]
call fcn.004e409c
push 0
lea eax, [ebp - 8]
push eax
push 0x8000
lea edx, [ebp - 0x800c]
push edx
push esi
call fcn.004e3e64
test eax, eax
je 0x44ede7
cmp dword [ebp - 8], 0
ja 0x44ed9f
mov ebx, 1
push esi
call fcn.004e3c12
jmp 0x44edf9
mov ebx, 0xfffffffa
push dword [ebp - 4]
call fcn.004e4072
jmp 0x44ee08
mov ebx, 0xfffffffc
push dword [ebp - 4]
call fcn.004e406c
jmp 0x44ee17
mov ebx, 0xfffffffd
push dword [ebp - 4]
call fcn.004e4060
jmp 0x44ee26
mov ebx, 0xfffffffe
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4670b8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
movzx eax, word [ebp + 8]
cmp eax, 0x68
jg 0x467119
je 0x467208
cmp eax, 4
jg 0x4670fd
je 0x4671c6
sub eax, 1
jb 0x46716b
je 0x46717f
dec eax
je 0x46719e
dec eax
je 0x4671b2
jmp 0x467272
sub eax, 0x65
je 0x4671cd
dec eax
je 0x4671e7
dec eax
je 0x4671f1
jmp 0x467272
cmp eax, 0x3ec
jg 0x46714d
je 0x467230
sub eax, 0x69
je 0x46720c
sub eax, 0x380
je 0x467210
dec eax
je 0x467218
dec eax
je 0x46721c
jmp 0x467272
sub eax, 0x3ed
je 0x46724a
dec eax
je 0x46726e
dec eax
je 0x467214
jmp 0x467272
lea edx, [ebp - 0x20]
push edx
call fcn.004e3dd4
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x467274
lea edx, [ebp - 0x40]
push edx
call fcn.004e3dd4
cmp dword [ebp - 0x34], 0xffffffff
jae 0x467193
mov eax, dword [ebp - 0x34]
jmp 0x467196
or eax, 0xffffffff
shr eax, 0xa
jmp 0x467274
lea edx, [ebp - 0x60]
push edx
call fcn.004e3dd4
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x467274
lea edx, [ebp - 0x80]
push edx
call fcn.004e3dd4
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x467274
xor eax, eax
jmp 0x467274
lea edx, [ebp - 0xa0]
push edx
call fcn.004e3dd4
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x467274
mov eax, 1
jmp 0x467274
lea edx, [ebp - 0xc0]
push edx
call fcn.004e3dd4
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
jmp 0x467274
cmp dword [0x70be14], 0
je 0x46722c
mov eax, dword [0x7299c4]
jmp 0x467274
xor eax, eax
jmp 0x467274
cmp dword [0x70be14], 0
je 0x467246
mov eax, dword [0x7299c4]
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x467274
xor eax, eax
jmp 0x467274
cmp dword [0x70be14], 0
je 0x46726a
mov eax, dword [0x7299bc]
sub eax, dword [0x7299b8]
test eax, eax
jns 0x467265
add eax, 3
sar eax, 2
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
jmp 0x467274
xor eax, eax
mov esp, ebp
pop ebp
ret