joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4247c7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.004dac16
mov esi, eax
push ebx
call fcn.004dadf0
push eax
call fcn.004dad90
mov dword [ebp - 8], eax
call fcn.00423fe0
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.004dad7e
push 0x714daa
push ebx
call dword [0x714c74]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.004dac4c
lea edx, [ebp - 0x10]
push edx
push ebx
call fcn.004dadf0
push eax
call fcn.004daf46
push 0xcc0020
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x6c]
push ecx
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
push eax
push 0
push 0
push esi
call fcn.004da99e
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x68], 0x10
push 0
push 0
push 0xf0
push ebx
call fcn.004daf58
dec eax
jne 0x42488d
push 0
lea ecx, [ebp - 0x70]
push ecx
push 5
push 2
push esi
push dword [ebp - 4]
call dword [0x714c78]
jmp 0x4248a1
push 0
lea eax, [ebp - 0x70]
push eax
push 1
push 2
push esi
push dword [ebp - 4]
call dword [0x714c78]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], 0xf
push ebx
call fcn.004dae38
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
push edi
push ebx
call fcn.004dae32
push 0
push 0
push 0xffffffffffffffff
push edi
push 1
push 1
call fcn.004da6ea
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
add edx, edx
push edx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0x31
push ebx
call fcn.004dadf0
push eax
call fcn.004dadf0
push eax
call fcn.004daf58
push eax
push esi
call fcn.004dab3c
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push edi
push 1
push 1
call fcn.004da6ea
add dword [ebp - 0x70], 2
add dword [ebp - 0x6c], 5
add dword [ebp - 0x64], 5
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x1c]
push 0
push 2
push esi
push dword [ebp - 4]
call dword [0x714c84]
push dword [ebp - 0x20]
push esi
call fcn.004dab3c
push dword [ebp - 0x1c]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push edi
call sym.SISCOM.EXE__hb_xfree
pop ecx
push dword [ebp - 4]
call dword [0x714c80]
push dword [ebp - 8]
push ebx
call fcn.004dadf0
push eax
call fcn.004daf3a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433f1b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.004da6f0
test ebx, ebx
jne 0x433f39
push esi
call fcn.004cfc0c
pop ecx
mov ebx, eax
cmp dword [0x716320], 0
je 0x433f47
call fcn.0043aee1
test ebx, ebx
jbe 0x433f55
push ebx
push esi
call fcn.0043b6af
add esp, 8
cmp dword [0x716320], 0
je 0x433f63
call fcn.0043af05
pop esi
pop ebx
pop ebp
ret

Function at 0x4373c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push esi
call fcn.00439a04
add esp, 8
mov esi, eax
push esi
call fcn.004cfc0c
pop ecx
mov ebx, eax
jmp 0x4373ec
dec ebx
test ebx, ebx
je 0x437407
movsx eax, byte [esi + ebx - 1]
push eax
push 0x716588
call fcn.004cfb3c
add esp, 8
test eax, eax
jne 0x4373eb
test ebx, ebx
je 0x437427
cmp ebx, 0x107
jg 0x437427
push esi
call fcn.004da588
cmp eax, 0xffffffff
jne 0x437422
xor edi, edi
jmp 0x437427
mov edi, eax
and edi, 0x10
push 0
call fcn.00439d3b
pop ecx
cmp dword [ebp - 4], 0
je 0x43743e
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x43859e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp dword [ebp + 0xc], 0
je 0x4385ac
xor eax, eax
jmp 0x4385b1
mov eax, 1
push eax
push dword [ebp + 8]
call fcn.00438000
pop ecx
push eax
call fcn.004da780
test eax, eax
setne bl
and ebx, 1
push 0
push ebx
call fcn.00439d51
add esp, 8
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x438acb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
call fcn.0046d990
push 0
lea eax, [ebp - 4]
push eax
movzx edx, word [ebp + 0x10]
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438000
pop ecx
push eax
call fcn.004da708
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
test ebx, ebx
je 0x438b09
mov ax, word [ebp - 4]
jmp 0x438b0b
xor eax, eax
mov ebx, eax
cmp bx, 0xffff
jne 0x438b16
xor ebx, ebx
call fcn.0046d98b
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x438b21
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
call fcn.0046d990
xor eax, eax
mov dword [ebp - 4], eax
test si, si
je 0x438b5a
push 0
lea edx, [ebp - 4]
push edx
movzx ecx, si
push ecx
push dword [ebp + 0xc]
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da7ce
mov ebx, eax
jmp 0x438b6e
xor eax, eax
mov dword [ebp - 4], eax
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da738
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
test ebx, ebx
je 0x438b83
mov dx, word [ebp - 4]
jmp 0x438b85
xor edx, edx
mov ebx, edx
call fcn.0046d98b
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x438b93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0046d990
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438000
pop ecx
push eax
call fcn.004da708
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x438bcd
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0046d990
test esi, esi
je 0x438c0b
push 0
push 0
lea edx, [ebp - 4]
push edx
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da7ce
push eax
call fcn.00439d51
add esp, 8
jmp 0x438c23
push 0
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da738
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x438c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004bd80a
test eax, eax
je 0x438c9d
call fcn.0046d990
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004cfa5c
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da708
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
jmp 0x438cd7
call fcn.0046d990
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00439145
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x438ccd
cmp eax, dword [ebp + 0x14]
jne 0x438ccd
push edi
push esi
push ebx
call fcn.00438b93
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x438cd2
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046d98b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438ce1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
call fcn.004bd80a
test eax, eax
je 0x438d4e
call fcn.0046d990
push 0x14
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.004cfa5c
add esp, 0xc
mov eax, dword [ebp + 0x14]
and eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov edx, eax
sar edx, 0x1f
mov dword [ebp - 0xc], eax
push 0
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call fcn.00438000
pop ecx
push eax
call fcn.004da7ce
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
jmp 0x438d88
call fcn.0046d990
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call fcn.00439145
add esp, 0x10
cmp edx, dword [ebp + 0x18]
jne 0x438d7e
cmp eax, dword [ebp + 0x14]
jne 0x438d7e
push edi
push esi
push ebx
call fcn.00438bcd
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x438d83
xor edx, edx
mov dword [ebp - 4], edx
call fcn.0046d98b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439262
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439a04
add esp, 8
mov ebx, eax
call fcn.0046d990
push ebx
call fcn.004da4e0
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
call fcn.0046d98b
cmp dword [ebp - 4], 0
je 0x4392a5
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x4392ab
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439a04
add esp, 8
mov ebx, eax
lea edx, [ebp - 8]
push edx
push esi
call fcn.00439a04
add esp, 8
mov esi, eax
call fcn.0046d990
push esi
push ebx
call fcn.004da6de
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
call fcn.0046d98b
cmp dword [ebp - 4], 0
je 0x439304
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
cmp dword [ebp - 8], 0
je 0x439313
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x43931b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439a04
add esp, 8
mov ebx, eax
call fcn.0046d990
push 0
push ebx
call fcn.004da4c2
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
call fcn.0046d98b
cmp dword [ebp - 4], 0
je 0x439360
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x439366
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439a04
add esp, 8
mov ebx, eax
call fcn.0046d990
push ebx
call fcn.004da732
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
call fcn.0046d98b
cmp dword [ebp - 4], 0
je 0x4393a9
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4393af
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
call fcn.00439a04
add esp, 8
mov ebx, eax
call fcn.0046d990
push ebx
call fcn.004da714
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
call fcn.0046d98b
cmp dword [ebp - 4], 0
je 0x4393f2
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x439419
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov word [ebp - 2], di
mov byte [ebx], 0
test di, di
je 0x439456
call fcn.00439596
and eax, 0xff
inc eax
mov word [ebp - 2], ax
cmp di, word [ebp - 2]
je 0x439456
mov edx, edi
add dl, 0xff
push edx
call fcn.00439515
pop ecx
call fcn.0046d990
push ebx
push esi
call fcn.004da558
push 0
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
call fcn.00439d0e
mov word [ebp - 4], ax
cmp di, word [ebp - 2]
je 0x439499
mov cl, byte [ebp - 2]
add cl, 0xff
push ecx
call fcn.00439515
pop ecx
mov ax, word [ebp - 4]
push eax
call fcn.00439d3b
pop ecx
mov byte [ebx + esi - 1], 0
cmp word [ebp - 4], 0
jne 0x43950b
cmp byte [ebx], 0
je 0x43950b
mov edi, ebx
push ebx
call fcn.004cfc0c
pop ecx
mov esi, eax
cmp byte [edi + 1], 0x3a
jne 0x4394c1
add edi, 2
sub esi, 2
movsx eax, byte [edi]
push eax
push 0x7165ea
call fcn.004cfb3c
add esp, 8
test eax, eax
je 0x4394d8
inc edi
dec esi
test esi, esi
je 0x4394f4
movsx edx, byte [edi + esi - 1]
push edx
push 0x7165ea
call fcn.004cfb3c
add esp, 8
test eax, eax
je 0x4394f4
dec esi
test esi, esi
je 0x439507
cmp edi, ebx
je 0x439507
push esi
push edi
push ebx
call fcn.004cfa10
add esp, 0xc
mov byte [ebx + esi], 0
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4395cb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov al, byte [ebp + 8]
add al, 0x41
mov byte [ebp - 4], al
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
call fcn.0046d990
lea edx, [ebp - 4]
push edx
call fcn.004da570
mov ebx, eax
call fcn.0046d98b
test ebx, ebx
je 0x439602
cmp ebx, 1
jne 0x439608
mov ax, 0xffff
jmp 0x43960a
xor eax, eax
mov ebx, eax
push 0
call fcn.00439d3b
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x439970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0
push ebx
push esi
call fcn.004da558
push 0
test eax, eax
setne al
and eax, 1
push eax
call fcn.00439d51
add esp, 8
call fcn.0046d98b
call fcn.00439d0e
test ax, ax
je 0x4399ae
call fcn.00439d0e
jmp 0x439a00
mov eax, ebx
cmp byte [eax + 1], 0x3a
jne 0x4399b9
add eax, 2
cmp eax, ebx
je 0x4399c8
push esi
push eax
push ebx
call fcn.004cfa10
add esp, 0xc
push ebx
call fcn.004cfc0c
pop ecx
mov esi, eax
movsx eax, byte [ebx + esi - 1]
push eax
push 0x7165ea
call fcn.004cfb3c
add esp, 8
test eax, eax
je 0x4399ee
mov byte [ebx + esi], 0
jmp 0x4399fe
push 0
push 0x7165ee
push ebx
call fcn.004baae8
add esp, 0xc
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x43a7d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0x63
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x43a80f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x43a80f
push 0x107
push dword [ebp + 8]
push ebx
call fcn.004bb464
add esp, 0xc
jmp 0x43a825
push ebx
push 0x107
call fcn.004da612
test eax, eax
jne 0x43a825
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
cmp byte [ebx], 0
je 0x43a841
push ebx
call fcn.004cfc0c
pop ecx
cmp byte [ebx + eax - 1], 0x5c
je 0x43a841
mov byte [ebx + eax], 0x5c
mov byte [ebx + eax + 1], 0
cmp dword [ebp + 0xc], 0
je 0x43a858
push 0x107
push dword [ebp + 0xc]
push ebx
call fcn.004bb49f
add esp, 0xc
push ebx
call fcn.004cfc0c
pop ecx
mov edi, eax
cmp edi, 0x101
jle 0x43a871
or eax, 0xffffffff
jmp 0x43a90d
call fcn.00440eab
fstp qword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 8], edx
fld qword [ebp - 0x10]
fmul dword [0x43a914]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
call fcn.004d42f4
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004d4710
add esp, 0xc
fstp qword [ebp - 0x10]
mov ecx, esi
cmp esi, 9
jle 0x43a8b4
mov al, 0x57
jmp 0x43a8b6
mov al, 0x30
add cl, al
mov byte [ebx + edi], cl
inc edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jl 0x43a87e
mov byte [ebx + edi], 0
cmp dword [ebp + 0x18], 0
je 0x43a8e0
push 0x107
push dword [ebp + 0x18]
push ebx
call fcn.004bb49f
add esp, 0xc
push 0
push ebx
call fcn.00439a04
add esp, 8
push 0x410
push dword [ebp + 0x10]
push ebx
call fcn.004386e3
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43a90d
dec dword [ebp - 4]
jne 0x43a7eb
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a918
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43a948
cmp byte [eax], 0
je 0x43a948
push 0x107
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004bb464
add esp, 0xc
jmp 0x43a96d
lea edx, [ebp - 0x108]
push edx
push 0x108
call fcn.004da612
test eax, eax
jne 0x43a96d
push 0
push 0
call fcn.00439d51
add esp, 8
xor eax, eax
jmp 0x43a99b
mov byte [ebp - 1], 0
push dword [ebp + 8]
push 0
test ebx, ebx
jne 0x43a97f
mov ebx, 0x716684
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.004da60c
mov ebx, eax
push 0
push ebx
call fcn.00439d51
add esp, 8
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c534
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [0x716738]
mov dword [ebp - 8], eax
mov eax, dword [0x71673c]
mov dword [ebp - 4], eax
push 7
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov ebx, eax
push 0
push dword [ebp + 0xc]
push ebx
call fcn.004bab2d
add esp, 0xc
push 0
push 0x716744
push ebx
call fcn.004baae8
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
push ebx
call fcn.004da510
mov esi, eax
cmp esi, 0xffffffff
je 0x43c5d6
test byte [ebp - 0x148], 0x10
je 0x43c5bf
lea eax, [ebp - 0x134]
push eax
lea edx, [ebp - 8]
push edx
call fcn.004da4bc
dec eax
jne 0x43c5bf
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x148]
push eax
push esi
call fcn.004da516
test eax, eax
jne 0x43c591
push esi
call fcn.004da50a
push ebx
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ca7a
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x140
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
xor eax, eax
mov dword [edi + 0x13c], eax
push 0x258
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [edi + 0x13c], eax
mov ebx, dword [edi + 0x13c]
cmp dword [ebp + 0xc], 8
jne 0x43cb3a
mov eax, dword [0x716740]
mov dword [ebp - 8], eax
push 3
push dword [ebp + 8]
lea edx, [ebp - 8]
push edx
call fcn.004bb464
add esp, 0xc
mov dword [ebx], 0xffffffff
cmp byte [ebp - 6], 0
jne 0x43cae2
mov byte [ebp - 6], 0x5c
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x104
lea eax, [ebx + 0x14c]
push eax
lea edx, [ebp - 8]
push edx
call fcn.004da63c
test eax, eax
je 0x43cb33
lea ecx, [ebp - 8]
push ecx
lea eax, [ebx + 0x250]
push eax
call fcn.0043c534
add esp, 8
mov esi, 1
push dword [ebp + 0xc]
call fcn.0043c689
pop ecx
mov dword [ebx + 0x144], eax
jmp 0x43cc3b
xor esi, esi
jmp 0x43cc3b
push dword [ebp + 8]
call fcn.004cfc0c
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebx], 0xffffffff
xor esi, esi
cmp dword [ebp - 0xc], 0
je 0x43cc3b
push 0
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.004bab2d
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
cmp byte [eax + edx - 1], 0x5c
jne 0x43cb97
push 0
push 0x716744
push dword [ebp - 0xc]
call fcn.004baae8
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push dword [ebp - 0xc]
call fcn.004da510
mov dword [ebx], eax
push dword [ebp + 0xc]
call fcn.0043c689
pop ecx
mov dword [ebx + 0x144], eax
cmp dword [ebx], 0xffffffff
je 0x43cc32
cmp dword [ebx + 0x144], 0
je 0x43cbd9
cmp dword [ebx + 4], 0
je 0x43cbd9
test byte [ebx + 4], 0x80
jne 0x43cbd9
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43cbe0
mov esi, 1
jmp 0x43cc32
test byte [ebx + 4], 0x10
jne 0x43cbf1
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43cbf8
mov esi, 1
jmp 0x43cc32
xor esi, esi
jmp 0x43cc23
cmp dword [ebx + 0x144], 0
je 0x43cc1c
cmp dword [ebx + 4], 0
je 0x43cc1c
test byte [ebx + 4], 0x80
jne 0x43cc1c
mov eax, dword [ebx + 0x144]
and eax, dword [ebx + 4]
je 0x43cc23
mov esi, 1
jmp 0x43cc32
lea eax, [ebx + 4]
push eax
push dword [ebx]
call fcn.004da516
test eax, eax
jne 0x43cbfc
push dword [ebp - 0xc]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push 0
push esi
call fcn.00439d51
add esp, 8
test esi, esi
je 0x43cc53
push edi
call fcn.0043c8c7
pop ecx
jmp 0x43cc5c
push edi
call fcn.0043ccd9
pop ecx
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441144
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0x8007
call fcn.004da73e
mov dword [0x716a24], eax
push 0x4410b1
call fcn.004da768
call fcn.004da564
push eax
push 0
push 0x4410cb
push 3
call fcn.004daff4
mov dword [0x716a20], eax
push 1
push 0x441129
call fcn.004da726
pop ebp
ret
Function at 0x44ec89
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call fcn.004da636
cmp dword [ebp - 0x98], 2
jne 0x44ecf7
cmp dword [ebp - 0xa4], 5
jb 0x44ecf7
push str.winspool.drv
call fcn.004da6b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44ecf7
push str.GetDefaultPrinterA
push dword [ebp - 4]
call fcn.004da5d0
test eax, eax
je 0x44ecef
push edi
push ebx
call eax
mov esi, eax
push dword [ebp - 4]
call fcn.004da534
test esi, esi
jne 0x44ed3c
push dword [edi]
push ebx
push 0x7172e4
push str.device
push str.windows
call fcn.004da5e8
test eax, eax
je 0x44ed39
cmp eax, dword [edi]
jae 0x44ed39
xor eax, eax
jmp 0x44ed1f
inc eax
cmp byte [ebx + eax], 0
je 0x44ed2b
cmp byte [ebx + eax], 0x2c
jne 0x44ed1e
mov byte [ebx + eax], 0
inc eax
mov dword [edi], eax
mov esi, 1
jmp 0x44ed3c
inc eax
mov dword [edi], eax
test esi, esi
jne 0x44ede2
cmp dword [ebp - 0x98], 1
jne 0x44ede2
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 2
push 0
push 1
call fcn.004da91c
test eax, eax
je 0x44ede2
cmp dword [ebp - 8], 0
jbe 0x44ede2
push dword [ebp - 8]
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44ede2
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 8]
push edx
push dword [ebp - 8]
push dword [ebp - 0x10]
push 2
push 0
push 1
call fcn.004da91c
test eax, eax
je 0x44edd9
cmp dword [ebp - 0xc], 0
jbe 0x44edd9
mov ecx, dword [ebp - 0x10]
push dword [ecx + 4]
call fcn.004da822
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44edd9
mov eax, dword [edi]
cmp eax, dword [ebp - 0x14]
jbe 0x44edd9
mov edx, dword [ebp - 0x10]
push dword [edx + 4]
push ebx
call fcn.004da816
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [edi], ecx
mov esi, 1
push dword [ebp - 0x10]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret