joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e340
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x511530]
add eax, 4
imul eax, eax, 0x108
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push eax
call fcn.004c4f28
add esp, 4
mov dword [0x514a00], eax
test eax, eax
jne 0x41e36f
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [0x51161c]
push 0x404160
mov edi, eax
push 0x4ef6d80
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x515edc]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0xe
push ecx
mov dword [0x51161c], eax
call edi
call fcn.004010d0
cmp dword [ebp], 0
jne 0x41e3b3
mov ebx, 1
jmp 0x41e462
mov edx, dword [0x51161c]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xec], 0
call esi
cmp byte [0x516035], 0
mov ecx, dword [0x51161c]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], 0x64
jne 0x41e403
mov eax, dword [0x515edc]
push 0x403fd0
push 0x64
push 0xb
push eax
call edi
test eax, eax
setne cl
mov byte [0x516035], cl
mov byte [ebp + 0xae1], 1
call esi
mov ecx, dword [ebp]
push 0
mov esi, 1
add dword [0x51604c], esi
push 0
push esi
mov dword [ebp + 0xafc], eax
mov dword [ebp + 0xaf8], eax
call fcn.00425f30
sub dword [0x51604c], esi
cmp byte [0x516035], 0
mov ebx, eax
je 0x41e45b
mov edx, dword [0x515edc]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x41e45b
mov byte [0x516035], 0
mov byte [ebp + 0xae1], 0
mov ebp, dword [0x51161c]
cmp dword [ebp + 0x104], 0
je 0x41e4bc
mov eax, dword [ebp + 0x104]
cmp dword [eax + 8], 6
jne 0x41e487
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0x104]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x41e49d
push eax
call fcn.004c57e5
add esp, 4
mov ecx, dword [ebp + 0x104]
push ecx
call fcn.004c57da
mov dword [ebp + 0x104], 0
mov ebp, dword [0x51161c]
add esp, 4
mov eax, ebp
call fcn.00401450
mov edx, dword [0x5166e0]
push 1
push 0
push 0xffffffffffffffff
mov byte [ebp + 0xec], 1
push 0x4e1a5c
mov ecx, 0x42
mov esi, ebp
mov edi, 0x514b10
rep movsd dword es:[edi], dword [esi]
push edx
mov byte [ebp + 0xec], 1
mov dword [ebp + 0xe0], 0
mov word [ebp + 0xed], 1
mov dword [ebp + 0x2c], SysStringLen
call fcn.004aa2a0
mov eax, dword [0x51164c]
cmp word [eax], 0
jne 0x41e554
cmp dword [0x516750], 0
jne 0x41e554
cmp dword [0x51600c], 0
jne 0x41e554
cmp dword [0x516010], 0
jne 0x41e554
cmp byte [0x516019], 0
jne 0x41e554
neg ebx
sbb ebx, ebx
and ebx, 6
push 0
inc ebx
push ebx
push 0x516ea8
call fcn.0041e5a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x41e5a0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub esp, 0x124
push ebx
xor ebx, ebx
push esi
push edi
mov dword [eax + 0xa9c], ecx
cmp byte [0x519533], bl
jne 0x41e73e
cmp byte [eax + 0xae0], bl
je 0x41e73e
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x5166e0]
push ebx
push 1
mov dword [0x51a560], eax
call fcn.004016f0
push 0x7f
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004c67b5
mov eax, dword [0x51161c]
inc dword [0x51604c]
add eax, 0x108
xor edx, edx
mov edi, eax
mov word [esp + 0x13a], dx
mov ecx, 0x42
mov esi, 0x514b10
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x51161c], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x516ea8
call fcn.0041e240
mov dword [0x517990], ebx
mov dword [0x517994], ebx
cmp dword [0x516080], ebx
je 0x41e665
mov eax, dword [0x511644]
cmp eax, ebx
je 0x41e659
mov eax, dword [eax]
cmp eax, ebx
jne 0x41e65e
mov eax, 0x4e1a4c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0xa90]
mov edi, dword [0x511524]
mov dword [0x511524], ebx
mov byte [0x519533], 1
mov byte [esp + 0xf], 1
mov byte [0x513368], bl
cmp ecx, ebx
je 0x41e6a5
call fcn.00401760
test eax, eax
je 0x41e6a5
cmp byte [0x513368], bl
jne 0x41e6a5
mov byte [esp + 0xf], bl
mov byte [0x513368], 1
cmp byte [esp + 0xf], bl
je 0x41e6fd
call fcn.00444e40
mov dword [esp + 0x10], eax
mov eax, dword [0x51a560]
cdq
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esi + 0xa90], ebx
lea ecx, [esp + 0x10]
sete al
mov dword [esp + 0x24], edx
lea edx, [esi + 0xa5c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], 1
push eax
push 2
push ecx
push edx
call fcn.0049cc60
cmp eax, 3
jne 0x41e6fd
mov byte [esp + 0xf], bl
mov byte [0x519533], bl
cmp byte [esp + 0xf], bl
jne 0x41e730
cmp dword [ebp + 0xc], 2
je 0x41e730
lea eax, [esp + 0x30]
push eax
call fcn.00403e40
add esp, 4
mov dword [0x511524], edi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call fcn.0041e780
cmp byte [0x513368], bl
jne 0x41e773
cmp ecx, 7
jne 0x41e773
mov eax, dword [0x515e60]
cmp word [eax], bx
je 0x41e75e
mov ecx, dword [ebp + 0x10]
mov dword [0x51a560], ecx
pop edi
pop esi
mov byte [0x513368], 1
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
push edx
push ecx
push eax
call fcn.0041e780
int3
Function at 0x42ede0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], eax
xor eax, eax
push edi
mov edi, 8
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], str.What
mov dword [esp + 0x48], eax
cmp esi, eax
jne 0x42ee6d
movzx esi, word [ecx]
imul esi, esi, 0x15
mov esi, dword [esi + 0x5118d8]
mov dword [esp + 0x40], esi
movzx esi, word [ecx + 4]
mov ecx, dword [ecx + 8]
mov esi, dword [esi*4 + 0x514e0c]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], 0x4ec338
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x70], str.Line
mov dword [esp + 0x88], 1
mov dword [esp + 0x84], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x90], str.Message
mov dword [esp + 0xa8], eax
mov dword [esp + 0xa0], ecx
cmp edx, eax
je 0x42ef0d
cmp word [edx], ax
je 0x42ef0d
mov edi, 0xa
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb0], str.Extra
mov dword [esp + 0xc8], eax
mov dword [esp + 0xc0], edx
lea edx, [esp + 8]
push edi
push edx
call fcn.00499d10
add esp, 8
pop edi
pop esi
add esp, 0xc8
ret 4
Function at 0x42f8d0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.004d0b30
cmp dword [esp + 0x4008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x4018]
mov ebx, ecx
je 0x42fa05
test ebx, ebx
jne 0x42f908
mov eax, dword [esp + 0x400c]
mov ebx, dword [eax + 0x634]
test ebx, ebx
je 0x42f912
movzx ecx, word [ebx + 4]
movzx eax, word [ebx + 8]
jmp 0x42f91f
mov ecx, dword [eax + 0x270]
movzx eax, word [eax + 0x274]
mov edx, dword [esp + 0x4014]
mov ecx, dword [ecx*4 + 0x514e0c]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push str.w_rzw6rhroolr
call fcn.0049fc00
add esp, 4
push eax
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.004a71f0
add esp, 0x10
cmp word [ebp], 0
lea edi, [esp + eax*2 + 0x10]
je 0x42f982
push ebp
push str.rrrrr
call fcn.0049fc00
add esp, 4
push eax
lea eax, [esp + 0x18]
mov edx, edi
sub edx, eax
sar edx, 1
sub esi, edx
call fcn.004a71f0
add esp, 8
mov esi, dword [esp + 0x4018]
cmp esi, 3
jne 0x42f9b1
call fcn.004c5451
add eax, 0x20
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.004c6dab
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x42fa03
test ebx, ebx
jne 0x42f9d6
mov ecx, dword [esp + 0x4014]
mov ebx, dword [ecx + 0x634]
test ebx, ebx
je 0x42f9f5
mov eax, dword [esp + 0x401c]
push ebp
push 1
push eax
mov ecx, ebx
call fcn.0042f1b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
mov edx, dword [esp + 0x401c]
push ebp
push edx
call fcn.004768b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4000
ret 0x10
Function at 0x42fed0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3d8
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x42fef7
push 0x64
lea ecx, [esp + 0x124]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x42ff01
xor edx, edx
mov word [esp + 0x120], dx
mov esi, dword [0x517948]
xor eax, eax
mov word [esp + 0x20], ax
test esi, esi
je 0x42ffb8
cmp byte [esi + 0x11], 0
je 0x42ff59
mov ecx, dword [esi]
push ecx
call fcn.0049cb60
add esp, 4
sub eax, 0
je 0x42ff3d
dec eax
je 0x42ff36
mov eax, str.Object
jmp 0x42ff42
mov edx, dword [esi]
mov eax, dword [edx + 4]
jmp 0x42ff42
mov eax, dword [esi]
mov eax, dword [eax + 4]
push eax
push 0x4ecc58
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.004a7230
add esp, 8
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x42ff16
cmp word [esp + 0x20], si
je 0x42ffb8
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ff70
sub eax, edx
sar eax, 1
cmp eax, 0x7b
jbe 0x42ffa6
mov esi, 0x7f
sub esi, eax
push esi
lea edi, [esp + eax*2 + 0x24]
push 0x4e7b20
push edi
call fcn.004c67b5
add esp, 0xc
xor ecx, ecx
mov word [edi + esi*2], cx
jmp 0x42ffb8
cmp word [esp + eax*2 + 0x1e], 0x20
lea eax, [esp + eax*2 + 0x20]
jne 0x42ffb8
xor edx, edx
mov word [eax - 2], dx
mov eax, dword [0x514a00]
cmp byte [eax + 0xf8], 0
je 0x42ffd7
cmp byte [0x517989], 0
mov dword [esp + 0x14], 1
je 0x42ffdf
mov dword [esp + 0x14], 0
mov eax, dword [0x51604c]
cmp eax, 1
jle 0x430001
push str.rz__77__76hr:7r____r_7__7r_:7_r:7r1__7_r:_736r4____:7_
call fcn.0049fc00
mov dword [esp + 0x1c], eax
mov eax, dword [0x51604c]
add esp, 4
jmp 0x430009
mov dword [esp + 0x18], 0x4e1a4c
cmp eax, 1
jle 0x430013
lea ebp, [eax - 1]
jmp 0x430015
xor ebp, ebp
cmp dword [0x516010], 0
mov edi, 0x4e5f90
je 0x430028
mov edi, 0x4e5f88
cmp dword [0x51600c], 0
mov esi, 0x4e5f90
je 0x43003b
mov esi, 0x4e5f88
lea ecx, [esp + 0x1e8]
push ecx
push 1
call fcn.00413740
add esp, 4
mov bl, al
call fcn.00413b30
mov edx, dword [0x516048]
mov ecx, dword [0x516050]
sub ecx, dword [esp + 0x18]
add esp, 4
push eax
mov eax, dword [0x51604c]
push edx
mov edx, dword [esp + 0x20]
push eax
push ecx
mov ecx, dword [0x517950]
push edx
mov edx, dword [0x517954]
push ebp
lea eax, [esp + 0x38]
push eax
push ecx
push edx
push edi
push esi
lea eax, [esp + 0x14c]
push eax
push 0x4eccf0
call fcn.0049fc00
mov edi, dword [esp + 0x420]
add esp, 4
push eax
mov esi, 0xfffe
call fcn.004a71f0
lea esi, [edi + eax*2]
mov ecx, esi
mov ebx, edi
sub ecx, ebx
sar ecx, 1
mov edx, 0xfffe
add esp, 0x34
sub edx, ecx
push edx
push esi
call fcn.00409ab0
mov eax, esi
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4300d6
sub eax, edx
sar eax, 1
cmp dword [0x5166f0], 0
lea edi, [esi + eax*2]
je 0x4300f8
push 0x4ec2a8
jmp 0x4300fd
push 0x4ece68
call fcn.0049fc00
add esp, 4
push eax
mov eax, edi
sub eax, ebx
sar eax, 1
mov esi, 0xfffe
sub esi, eax
call fcn.004a71f0
add esp, 4
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3d8
ret 4
Function at 0x437790
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.00443bd0
mov edi, eax
test edi, edi
je 0x4377be
mov esi, dword [esp + 0x1c]
push edi
call fcn.004abc70
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x437809
mov ecx, dword [0x51161c]
test byte [ecx + 0x100], 1
jne 0x4377ec
mov edx, dword [0x5166e0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6784
push edx
call fcn.004aa2a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x4e1a4c
push 0
push 0x4e6784
call fcn.0042ef30
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x437841
cmp ebp, dword [0x516e90]
je 0x437841
mov esi, edi
call fcn.004ac1d0
test al, al
jne 0x437841
mov eax, dword [0x516e90]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x43787f
mov edx, dword [0x5166e0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e1a5c
push edx
call fcn.004aa2a0
mov eax, dword [0x51161c]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x43787f
push 1
push eax
call fcn.00401930
add esp, 8
test bl, bl
je 0x437893
mov ecx, dword [0x516e90]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x438580
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.004314b0
mov ebx, eax
test ebx, ebx
jne 0x4385bc
push esi
push eax
push 0x4e7114
call fcn.0049fc00
mov ecx, dword [ebp + 8]
add esp, 4
push eax
call fcn.0042f1b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x4385c8
jmp dword [eax*4 + 0x4387c8]
mov eax, dword [ebp + 0xc]
cmp word [eax], 0
je 0x4385e3
push eax
call fcn.00455050
add esp, 4
jmp 0x4385e9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x5166e0]
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00455050
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x438661
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x438661
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x5166e0]
push 0x18
push 0
push esi
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x5166e0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e1a5c
push ecx
call fcn.004aa2a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [edi]
push edx
call fcn.004c6f58
movzx eax, ax
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x43869f.67
movzx eax, byte [eax + 0x4387f8]
jmp dword [eax*4 + 0x4387dc]
mov esi, 0x40
jmp 0x4386ce
mov esi, 0x4000
jmp 0x4386ce
mov esi, 0x20
jmp 0x4386ce
mov esi, 0x8000
jmp 0x4386ce
mov esi, 0x80
jmp 0x4386ce
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp word [eax], 0
je 0x4386e2
push eax
call fcn.00455050
add esp, 4
jmp 0x4386e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x438661
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x438661
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x438635
mov edx, dword [0x5166e0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e1a5c
push edx
call fcn.004aa2a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp word [edi], 0
je 0x438762
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.0041bc20
fmul qword [0x50a098]
call fcn.004d3dc0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x438770
mov byte [esp + 0x13], 1
xor edi, edi
lea esp, [esp]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00455050
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x43878d
test esi, esi
jne 0x438644
jmp 0x438791
test esi, esi
je case.0x43869f.67
cmp byte [esp + 0x13], 0
jne 0x4387af
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x438644
push 1
push 0x64
call fcn.00401930
add esp, 8
jmp 0x438770
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x439040
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [0x515e10]
push edi
push eax
mov eax, dword [esp + 0x18]
call fcn.00443bd0
mov edi, eax
test edi, edi
je 0x439066
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [eax + 1]
jmp 0x43906b
mov ebp, 1
push 1
push 0
lea ecx, [ebp - 1]
push ecx
push 0
push esi
call fcn.004aa2a0
cmp eax, 1
je 0x439089
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov ecx, esi
test edi, edi
je 0x43911b
push ebp
push 0
push 1
call fcn.004016f0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [esi + 0x17], 0
mov ebp, eax
jne 0x4390b2
mov edi, dword [esi + 0xc]
jmp 0x4390b4
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x4390cc
test byte [edi + 0x15], 8
je 0x4390c7
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x4390d1
mov eax, 0x51952c
lea edx, [ebp + ebp]
mov dword [eax], edx
cmp byte [esi + 0x17], 0
jne 0x4390e2
mov edi, dword [esi + 0xc]
jmp 0x4390e4
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x4390fc
test byte [edi + 0x15], 8
je 0x4390f7
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x439101
mov eax, 0x51952c
test dword [eax], 0xfffffffe
jne 0x439158
push 0
push 1
mov ecx, esi
call fcn.004016f0
xor ecx, ecx
mov word [eax], cx
jmp 0x439158
push 0
push 1
call fcn.004016f0
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], dl
jne 0x439133
mov edi, dword [esi + 0xc]
jmp 0x439135
mov edi, esi
cmp byte [edi + 0x17], 1
jne 0x43914d
test byte [edi + 0x15], 8
je 0x439148
mov eax, edi
call fcn.00401610
lea eax, [edi + 0xc]
jmp 0x439152
mov eax, 0x51952c
mov dword [eax], 0
cmp byte [esi + 0x17], 0
jne 0x439161
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x439181
cmp dword [0x5179f4], 0
je 0x439181
mov ecx, 0x5179e8
call fcn.00404c10
pop edi
pop esi
pop ebp
pop ecx
ret 4
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4

Function at 0x439fe0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10000
call fcn.004d0b30
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
mov esi, dword [0x515e10]
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0x7fff
jb 0x43a094
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push esi
call fcn.004aa2a0
test eax, eax
jne 0x43a032
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
push edi
push 0
push 1
mov ecx, esi
call fcn.004016f0
push eax
push ebx
call ebp
test eax, eax
jne 0x43a055
push eax
push 1
mov ecx, esi
call fcn.004016f0
xor edx, edx
mov word [eax], dx
cmp byte [esi + 0x17], 0
jne 0x43a05e
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 2
jne 0x43a081
cmp dword [0x5179f4], 0
je 0x43a081
mov ecx, 0x5179e8
call fcn.00404c10
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
and byte [esi + 0x15], 0x86
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x43a0a1
mov eax, 0x4e1a4c
push 1
push 0
push edi
push eax
push esi
call fcn.004aa2a0
pop edi
pop esi
pop ebp
add esp, 0x10000
ret
Function at 0x43b420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
mov eax, dword [0x517980]
push ebp
push eax
mov edi, ecx
push str.__s_s
mov esi, 0x800
call fcn.004a71f0
mov esi, eax
lea ecx, [esi + 1]
add esp, 0xc
cmp ecx, 0x800
jg 0x43b47b
lea edx, [edi + 2]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b47b
mov edx, dword [esp + 0x18]
mov dword [edi + esi*2], 0x22
mov ecx, dword [0x517980]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov al, 1
pop ebx
ret
call fcn.0043bab0
test eax, eax
je 0x43b4c8
push ebp
push ebx
push str.__s_s
mov esi, 0x800
call fcn.004a71f0
mov esi, eax
lea edx, [esi + 1]
add esp, 0xc
cmp edx, 0x800
jg 0x43b4c8
lea eax, [edi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b4c8
mov eax, dword [esp + 0x18]
mov dword [edi + esi*2], 0x22
pop edi
pop esi
mov dword [eax], ebx
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x43b4d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x2210
call fcn.004d0b30
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
lea ebx, [esp + 0x1224]
push ecx
lea eax, [esp + 0x20]
mov ecx, ebx
mov ebp, 0x4e1a4c
call fcn.0043b420
add esp, 8
test al, al
jne 0x43b50d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2210
ret
cmp byte [esp + 0x2224], 0
je 0x43b582
push 0x4ef03c
call fcn.0049fc00
mov edx, dword [esp + 0x18]
add esp, 4
push eax
push edx
push str.__s_s
mov esi, 0x800
lea edi, [esp + 0x22c]
call fcn.004a71f0
mov esi, eax
lea eax, [esi + 1]
add esp, 0xc
cmp eax, 0x800
jg 0x43b582
lea ecx, [esp + 0x222]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b582
mov edx, 0x22
xor eax, eax
mov word [esp + esi*2 + 0x220], dx
mov word [esp + esi*2 + 0x222], ax
mov ebx, edi
lea ebp, [esp + 0x1220]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0x516ea8
mov ecx, ebx
call fcn.00430130
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x2210
ret
Function at 0x43f2f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x218
push ebx
push ebp
mov ebp, dword [0x515e10]
push esi
push edi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push 0
mov eax, esi
call fcn.00414250
mov bl, al
add esp, 0xc
test bl, bl
jne 0x43f38f
push 0
lea ebx, [esp + 0x18]
mov eax, esi
call fcn.00450590
mov edi, eax
add esp, 4
test edi, edi
jne 0x43f352
push 1
push eax
push 0xffffffffffffffff
push 0x4e1a4c
push ebp
call fcn.004aa2a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
mov dword [esp + 0x18], eax
push 0
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0
call fcn.00450880
fstp st(0)
add esp, 8
lea eax, [esp + 0x18]
mov ebx, ebp
call fcn.004a9bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4
mov edx, dword [esp + 0x22c]
movzx esi, word [edx]
test esi, 0xffffff80
jne 0x43f3b3
push 2
push esi
call fcn.004c613e
add esp, 8
test eax, eax
je 0x43f3b3
and esi, 0xffffffdf
movzx eax, si
cmp eax, 0x50
je 0x43f3cb
xor ecx, ecx
cmp eax, 0x54
setne cl
lea eax, [ecx - 1]
and eax, 2
jmp 0x43f3d0
mov eax, 1
push eax
call fcn.004507d0
add esp, 4
test al, al
mov eax, 0x4ef6ac
jne 0x43f3e7
mov eax, 0x4ef6b0
push 1
push 0
push 0xffffffffffffffff
push eax
push ebp
call fcn.004aa2a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret 4