joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b0c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, ecx
test ebx, ebx
je 0x43b285
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43b0fe
sub eax, 1
je 0x43b0f3
sub eax, 1
jne 0x43b0fe
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ebp
mov dword [esi + 4], eax
push edi
jmp 0x43b120
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebp
push edi
jmp 0x43b120
mov ebx, dword [esp + 0x34]
jmp 0x43b120
cmp dword [esi + 0xc], 0
mov dword [esp + 0x10], 0
je 0x43b174
xor edi, edi
test ebx, ebx
jbe 0x43b199
mov eax, ebx
sub eax, edi
cmp eax, 0x4000
jb 0x43b144
mov eax, 0x4000
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push eax
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x43b199
add edi, 0x4000
cmp edi, ebx
jb 0x43b134
jmp 0x43b191
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x43b27f
cmp byte [esi + 0x14], 0
je 0x43b27f
cmp dword [esi + 0xc], 0
jne 0x43b27f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov ebx, eax
lea eax, [esi + 0x1e]
push eax
mov dword [esp + 0x24], edx
call fcn.0043bcc0
push edi
mov dword [esp + 0x18], eax
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp ebp, eax
mov ebp, dword [esp + 0x34]
jb 0x43b224
ja 0x43b1ec
cmp dword [esp + 0x14], ebp
jbe 0x43b224
mov edi, dword [esp + 0x20]
mov edx, ebx
sub edx, ebp
mov ecx, edi
sbb ecx, eax
test ecx, ecx
jg 0x43b224
jl 0x43b203
cmp edx, 0xffffffff
ja 0x43b224
mov ecx, ebp
add ecx, ebx
adc eax, edi
mov dword [esp + 0x28], eax
js 0x43b224
jg 0x43b216
cmp ecx, 0xffffffff
jbe 0x43b224
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x51e7a8
call fcn.00433580
push 0
lea eax, [esi + 0x1e]
push eax
mov ecx, 0x51e7a8
call fcn.004335d0
test al, al
je 0x43b26f
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x43b110
test eax, eax
jbe 0x43b110
mov edi, dword [esi]
mov edx, dword [edi + 0xc]
push 0
mov ecx, esi
call edx
mov ecx, dword [esp + 0x14]
xor ebx, ebx
sub eax, ecx
sbb edx, ebx
push edx
mov edx, dword [edi + 8]
push eax
mov ecx, esi
call edx
jmp 0x43b110
lea eax, [esi + 0x1e]
push eax
push 0
mov ecx, 0x51e7a8
call fcn.00433840
pop edi
mov byte [esi + 8], 1
pop ebp
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x43b490
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 1
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0xc], ebp
jne 0x43b4bc
cmp edi, 0x4e20
jbe 0x43b4b1
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43b55e
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x43b510
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x43b4f4
cmp eax, 3
jne 0x43b510
cmp edi, 0x4e20
jbe 0x43b510
push 0x4e20
push ebx
mov ecx, esi
call fcn.0043b490
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x43b52b
call ebp
cmp eax, 0x6d
jne 0x43b52b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
cmp dword [esi + 0xc], 0
jne 0x43b554
cmp edi, 0x8000
jbe 0x43b554
call ebp
cmp eax, 0x21
jne 0x43b554
push 0x8000
push ebx
mov ecx, esi
call fcn.0043b490
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x43bc30
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push 0x800
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00460240
movzx edx, word [esp]
neg edx
sbb edx, edx
lea eax, [esp]
and edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x43bc96
cmp eax, 5
je 0x43bc96
xor eax, eax
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 4
mov ecx, dword [esp + 0x1000]
xor ecx, esp
mov eax, 1
call fcn.004bfc52
add esp, 0x1004
ret 4

Function at 0x43bcc0
Capabilities:
Get disk size

Disassembly:
mov eax, 0x101c
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
push 0x800
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.0045fba0
lea edx, [esp + 0xc]
push edx
movzx edx, word [esp + 0x20]
xor esi, esi
lea eax, [esp + 0x18]
push eax
neg edx
lea ecx, [esp + 0xc]
sbb edx, edx
lea eax, [esp + 0x24]
push ecx
and edx, eax
push edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x43bd57
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
ja 0x43bd57
push 1
push esi
push esi
push eax
call fcn.004bfed0
mov ecx, dword [esp + 4]
add eax, ecx
adc edx, esi
pop esi
mov ecx, dword [esp + 0x1018]
xor ecx, esp
call fcn.004bfc52
add esp, 0x101c
ret 4
mov ecx, dword [esp + 0x101c]
pop esi
xor ecx, esp
xor eax, eax
xor edx, edx
call fcn.004bfc52
add esp, 0x101c
ret 4
Function at 0x43bd80
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1210
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x120c], eax
mov eax, dword [esp + 0x1214]
push 0x800
lea ecx, [esp + 0x210]
push ecx
push eax
call fcn.00460240
push 0x105
lea edx, [esp + 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x43be84
mov ecx, 0x4d83d8
lea eax, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43be0a
test dx, dx
je 0x43be06
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43be0a
add eax, 4
add ecx, 4
test dx, dx
jne 0x43bde4
xor eax, eax
jmp 0x43be0f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43be68
mov ecx, 0x4d83cc
lea eax, [esp]
jmp 0x43be20
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43be46
test dx, dx
je 0x43be42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43be46
add eax, 4
add ecx, 4
test dx, dx
jne 0x43be20
xor eax, eax
jmp 0x43be4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43be68
xor eax, eax
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004bfc52
add esp, 0x1210
ret 4
mov eax, 1
mov ecx, dword [esp + 0x120c]
xor ecx, esp
call fcn.004bfc52
add esp, 0x1210
ret 4
mov ecx, dword [esp + 0x120c]
xor ecx, esp
xor al, al
call fcn.004bfc52
add esp, 0x1210
ret 4

Function at 0x43bf00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push edi
mov edi, dword [esp + 0x1014]
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x43bf51
push 0x800
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00460b70
test al, al
je 0x43bf4f
lea ecx, [esp + 0xc]
push ecx
call ebx
jmp 0x43bf51
mov eax, esi
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 4

Function at 0x43bf70
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
mov esi, dword [esp + 0x1014]
push edi
mov edi, dword [esp + 0x101c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x43bfd0
push 0x800
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00460b70
test al, al
je 0x43bfd0
push edi
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
setne al
jmp 0x43bfd2
mov al, bl
mov ecx, dword [esp + 0x1010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 8
Function at 0x43bff0
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x43c06e
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.00460b70
test al, al
je 0x43c06e
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00460b70
test al, al
je 0x43c06e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x43c070
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x2004
ret 8

Function at 0x43c090
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x43c0e6
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00460b70
test al, al
je 0x43c0e6
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x43c0e8
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 4

Function at 0x43c110
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x43c166
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00460b70
test al, al
je 0x43c166
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x43c168
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 4

Function at 0x43c440
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
test eax, eax
jne 0x43c491
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00460b70
test al, al
je 0x43c4ad
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x43c4ad
cmp byte [esp + 0x1014], 0
je 0x43c4a9
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.0043bf70
xor eax, eax
jmp 0x43c4c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43c4c2
cmp eax, 3
mov eax, 1
jne 0x43c4c7
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004bfc52
add esp, 0x1004
ret 0xc
Function at 0x43c9f0
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x43ca48
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x43e4c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push 0x4000
call fcn.004c0bc4
add esp, 4
mov dword [esp], eax
test eax, eax
jne 0x43e4e2
mov eax, 4
add esp, 0xc
ret 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], esi
mov eax, edi
and eax, ebp
cmp eax, 0xffffffff
je 0x43e511
cmp esi, ebp
ja 0x43e5d2
jb 0x43e511
cmp ebx, edi
jae 0x43e5d2
call fcn.00452b90
cmp byte [0x51e7b0], 0
je 0x43e528
cmp byte [0x5344c0], 0
jne 0x43e596
mov ecx, edi
and ecx, ebp
cmp ecx, 0xffffffff
je 0x43e54d
mov ecx, edi
sub ecx, ebx
mov eax, ebp
sbb eax, esi
test eax, eax
ja 0x43e54d
jb 0x43e547
cmp ecx, 0x4000
jae 0x43e54d
mov eax, edi
sub eax, ebx
jmp 0x43e552
mov eax, 0x4000
mov edx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x18]
push 1
push eax
call fcn.004c2fc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43e5a5
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
push ecx
push esi
push 1
push edx
call fcn.004c2576
add esp, 0x10
cmp eax, esi
jne 0x43e5eb
add ebx, esi
adc dword [esp + 0x18], 0
mov esi, dword [esp + 0x18]
jmp 0x43e4f6
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x20]
push eax
call fcn.004c2cf2
add esp, 4
test eax, eax
je 0x43e5d2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004bff04
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0xc
ret 0x10
mov edx, dword [esp + 0x10]
push edx
call fcn.004bff04
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x10]
push eax
call fcn.004bff04
mov eax, dword [0x51fc88]
add esp, 4
test eax, eax
je 0x43e60e
push eax
push 0
mov ecx, 0x51e7a8
call fcn.00433810
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xc
ret 0x10
Function at 0x43ed00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4d27bb
mov eax, dword fs:[0]
push eax
mov eax, 0x202c
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x2028], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea93c]
xor eax, esp
push eax
lea eax, [esp + 0x2040]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2054]
mov ebp, dword [esp + 0x2050]
mov dword [esp + 0x14], esi
mov ecx, esi
mov eax, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43ed7b
test dx, dx
je 0x43ed77
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43ed7b
add eax, 4
add ecx, 4
test dx, dx
jne 0x43ed55
xor eax, eax
jmp 0x43ed80
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43ef23
lea eax, [esp + 0x103c]
push eax
push 0x800
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movzx ecx, word [esp + 0x103c]
push ecx
call fcn.004c281a
add esp, 4
cmp word [esp + 0x103c], 0x5c
mov edi, eax
je 0x43ee04
movzx eax, word [esi]
cmp ax, 0x5c
je 0x43ee04
cmp word [ebp], 0x5c
je 0x43ee04
movzx edx, ax
push edx
call fcn.004c281a
mov esi, eax
movzx eax, word [ebp]
push eax
call fcn.004c281a
mov edx, dword [esp + 0x1c]
mov ecx, 0x3a
add esp, 8
cmp word [edx + 2], cx
je 0x43edf4
mov esi, edi
cmp word [ebp + 2], cx
je 0x43edfc
mov eax, edi
cmp esi, eax
mov esi, edx
je 0x43ee04
mov bl, 1
push ebp
call fcn.0043c780
test al, al
je 0x43ee5d
lea ecx, [esp + 0x18]
call fcn.0043acd0
mov dword [esp + 0x2048], 0
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.0043ad10
test al, al
je 0x43ee9d
lea ecx, [esp + 0x18]
call fcn.0043afc0
test al, al
je 0x43ee9d
push ebp
call fcn.0043c090
test al, al
je 0x43ee9d
mov dword [esp + 0x2048], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0043b3e0
test bl, bl
jne 0x43ee75
push ebp
push esi
call fcn.0043bff0
test al, al
sete al
test al, al
je 0x43ef23
push 0x4d8484
push esi
call fcn.004c2c28
mov edi, eax
add esp, 8
test edi, edi
jne 0x43eeb8
push esi
push eax
mov ecx, 0x51e7a8
call fcn.00433770
lea eax, [edi + 0xa]
jmp 0x43ef25
mov dword [esp + 0x2048], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0043b3e0
mov eax, 0xf
jmp 0x43ef25
push 0x4d847c
push ebp
call fcn.004c2c28
mov esi, eax
add esp, 8
test esi, esi
jne 0x43eeda
push edi
call fcn.004c2398
add esp, 4
lea eax, [esi + 0xf]
jmp 0x43ef25
push 0
mov ecx, 0x51e7a8
call fcn.004332d0
push 0
push 0xffffffffffffffff
push esi
push edi
call fcn.0043e4c0
push edi
mov ebx, eax
call fcn.004c2398
add esp, 4
push 1
mov ecx, 0x51e7a8
call fcn.004332d0
push esi
call fcn.004c2398
add esp, 4
test eax, eax
jne 0x43ef4f
test ebx, ebx
jne 0x43ef4f
mov eax, dword [esp + 0x14]
push eax
call fcn.0043c090
xor eax, eax
mov ecx, dword [esp + 0x2040]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2028]
xor ecx, esp
call fcn.004bfc52
add esp, 0x2038
ret 8
push ebp
call fcn.0043c090
test ebx, ebx
je 0x43ef60
mov eax, ebx
cmp ebx, 0xa
jne 0x43ef25
mov eax, 0xe
jmp 0x43ef25
Function at 0x440d10
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x440dbf
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x440df3
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.00460b70
test al, al
je 0x440d8c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x440df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x440da8
cmp eax, 3
je 0x440da8
cmp eax, 0x12
je 0x440da8
mov eax, 1
jmp 0x440daa
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x440ed2
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x440df3
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x440ed2
push 0x800
push ebx
push esi
call fcn.0047e340
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.0045fad0
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.004bfed0
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.00481510
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.00481510
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.00481510
test dword [esp + 0x10], 0x400
je 0x440ec4
cmp dword [esp + 0x34], 0xa0000003
jne 0x440ec4
lea eax, [ebx + 1]
jmp 0x440ec6
xor eax, eax
mov byte [esi + 0x100e], al
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x1254
ret 0xc
Function at 0x4437c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x44383b
cmp eax, 0x40
jbe 0x4437e9
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0047d1c0
mov dword [esi + 0x9c], 0x14
mov eax, dword [esi + 0x9c]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, esi
push 0
push eax
call fcn.004c05a0
add esp, 0xc
xor eax, eax
jmp 0x443810
xor dword [esi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x443810
push edi
lea edi, [esi + 0x40]
push edi
call fcn.0047d100
push edi
push 0x40
push esi
call fcn.0047d140
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x443852
mov edx, dword [esp + 8]
add esi, 0x40
push esi
push eax
push edx
call fcn.0047d140
pop esi
ret 0xc

Function at 0x443860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
cmp dword [esi + 0x9c], 0xffffffff
je 0x44388b
push esi
push 0
push 0
call fcn.004437c0
push edi
lea edi, [esi + 0x40]
push edi
lea eax, [esp + 0x10]
push eax
call fcn.0047d1c0
xor eax, eax
lea esp, [esp]
xor dword [esi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x4438a0
push edi
call fcn.0047d100
push edi
push 0x40
push esi
call fcn.0047d140
push edi
push 0x14
lea ecx, [esp + 0x14]
push ecx
call fcn.0047d140
push edi
lea edx, [esp + 0x10]
push edx
call fcn.0047d1c0
mov eax, dword [esp + 0x2c]
pop edi
test eax, eax
jbe 0x4438ec
push eax
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.004c0c90
add esp, 0xc
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x18
ret 0xc
Function at 0x4454a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bfc47
add esp, 4
push esi
mov edi, eax
push edi
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [0x55d948]
push edi
call fcn.0047a2d0
push edi
call fcn.004947a0
push edi
call fcn.004c061a
add esp, 4
pop edi
pop esi
pop ebp
ret 4

Function at 0x4458f0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
push esi
push edi
push 0x4d8484
push eax
mov edi, ecx
call fcn.0043c420
mov esi, eax
test esi, esi
jne 0x44592c
lea eax, [esi + 0x32]
jmp 0x445a71
xor eax, eax
cmp edi, 0x8000
jbe 0x445a31
push ebx
push ebp
push eax
mov eax, edi
shr eax, 3
add eax, 0x1000
push eax
push esi
call fcn.004c36f1
push esi
push 0x1000
lea ecx, [esp + 0x28]
push 1
push ecx
call fcn.004c2fc6
add esp, 0x1c
push eax
lea ecx, [esp + 0x18]
call fcn.00445210
mov edx, edi
shr edx, 2
push 0
add edx, 0x1000
push edx
push esi
mov ebx, eax
call fcn.004c36f1
push esi
push 0x1000
lea eax, [esp + 0x28]
push 1
push eax
call fcn.004c2fc6
add esp, 0x1c
push eax
lea ecx, [esp + 0x18]
call fcn.00445210
lea ecx, [edi + edi]
shr ecx, 2
push 0
add ecx, 0x1000
push ecx
push esi
mov ebp, eax
call fcn.004c36f1
push esi
push 0x1000
lea edx, [esp + 0x28]
push 1
push edx
call fcn.004c2fc6
add esp, 0x1c
push eax
lea ecx, [esp + 0x18]
call fcn.00445210
mov dword [esp + 0x10], eax
lea eax, [edi + edi*2]
shr eax, 2
push 0
add eax, 0x1000
push eax
push esi
call fcn.004c36f1
push esi
push 0x1000
lea ecx, [esp + 0x28]
push 1
push ecx
call fcn.004c2fc6
add esp, 0x1c
push eax
lea ecx, [esp + 0x18]
call fcn.00445210
add eax, dword [esp + 0x10]
add eax, ebp
add eax, ebx
cdq
and edx, 3
add eax, edx
mov edi, eax
sar edi, 2
push esi
call fcn.004c2398
add esp, 4
pop ebp
mov eax, edi
pop ebx
jmp 0x445a71
cmp edi, 0x1000
jbe 0x445a41
lea eax, [edi - 0x1000]
shr eax, 1
push 0
push eax
push esi
call fcn.004c36f1
push esi
push 0x1000
lea edx, [esp + 0x20]
push 1
push edx
call fcn.004c2fc6
push esi
mov edi, eax
call fcn.004c2398
add esp, 0x20
push edi
lea ecx, [esp + 0x10]
call fcn.00445210
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
xor ecx, esp
call fcn.004bfc52
add esp, 0x1008
ret 4

Function at 0x448a50
Capabilities:
Get common file path

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp]
push ecx
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0xc]
test eax, eax
sete al
test al, al
je 0x448aa5
mov eax, dword [esp]
push ebx
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [esp + 4]
cmp eax, 1
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
sete bl
call eax
mov al, bl
pop ebx
add esp, 8
ret 4
xor ecx, ecx
mov word [edx], cx
add esp, 8
ret 4