joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4452f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x557aa3
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x55177e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445341
cmp edi, dword [esi + 0x7c]
jge 0x445341
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00459be5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00459be5
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557aa3
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557aa3
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445293
jmp 0x445263
call fcn.0045de0c
int3

Function at 0x4726ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4726fb
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x584f03
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x57ebde
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4727a1
cmp edi, dword [esi + 0x7c]
jge 0x4727a1
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00487045
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00487045
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f03
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f03
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4726f3
jmp 0x4726c3
call fcn.0048b26c
int3
Function at 0x4ae421
Capabilities:
Encode data using xor

Disassembly:
xor edx, dword [0x95c7922d]
retf 0x8f71
mov bl, 0x59
jle 0x4ae480
sbb al, 0x1b
ror dl, 1
adc al, 0xfc
loop 0x4ae3d3
cmpsb byte [esi], byte es:[edi]
pop esp
out 0xc3, eax
adc al, 0xfd
div ch
cmc
push ss
jne 0x4ae44d
cwde
jb 0x4ae448
adc eax, 0xf5fa4c49
jnp 0x4ae433
pop eax
xchg ebx, eax
js 0x4ae477
mov esp, 0x2a350f6a
in eax, dx
cmp dword [esi - 0x20], eax
push es
xor eax, 0x4639ed2a
loopne 0x4ae455
pushfd
lodsb al, byte [esi]
insb byte es:[edi], dx
jle 0x4ae4d3
popal
fisub word [edx + 0x64]
or al, 0x4c
xchg byte [eax - 0xb38e852], bl
lsl ebp, esp
push cs
push ecx
scasd eax, dword es:[edi]
push esi
and dword [ebp + eax*8 + 0x23b774e6], 0xd65611fd
jg 0x4ae4c0
sub byte [edi], ch
mov ebx, 0x92cba79b
call 0x5addd30b
movsd dword es:[edi], dword [esi]
xchg ebp, eax
sbb dword [ecx], ebp
mov ebp, 0xfb074177
push ebp
xchg esi, eax
inc ebp
invalid
and byte [esi + 0x451930b9], dl
fst dword [eax - 0x3a90505]
les edi, [edi]
outsb dx, byte [esi]
mov dh, 0xe7
enter 0xfffffffffffff185, 0xfffffffffffffff1
int1
int1
cmp al, 0xf5
sbb al, 0x6a
test eax, 0x9b24b66
sub ah, byte [ecx]
movsb byte es:[edi], byte [esi]
loope 0x4ae538
invalid
sbb byte [ebx + ecx*2 + 0x27130cdf], bl
dec dword [ecx + 0x47ef0f0]
sbb byte [ebx - 0x687fad97], ah
invalid

Function at 0x4b73a1
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd610
push 0x4b7260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c4d14], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c4d10], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c4d0c], ecx
shr eax, 0x10
mov dword [0x4c4d08], eax
push 1
call fcn.004b844f
pop ecx
test eax, eax
jne 0x4b73a3
push 0x1c
call fcn.004b7465
invalid
pop ecx
call fcn.004b820c
test eax, eax
jne 0x4b73b4
push 0x10
call fcn.004b7465
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004b8050
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c53d4], eax
call fcn.004b7f1e
mov dword [0x4c4cf8], eax
call fcn.004b7cd1
call fcn.004b7c18
call fcn.004b7928
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
adc eax, sym.imp.KERNEL32.dll_GetStartupInfoA
call fcn.004b7bc0
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b7403
movzx eax, word [ebp - 0x2c]
jmp 0x4b7406
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b7955
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b7a48
pop ecx
pop ecx
ret
Function at 0x4b79ae
Capabilities:
Terminate process

Disassembly:
add byte [ebp + 0x3c], dh
mov eax, dword [0x4c53d0]
test eax, eax
je 0x4b79dc
mov ecx, dword [0x4c53cc]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b79db
mov eax, dword [esi]
test eax, eax
je 0x4b79d0
call eax
sub esi, 4
cmp esi, dword [0x4c53d0]
jae 0x4b79c8
pop esi
push 0x4c0018
push 0x4c0014
call fcn.004b7a2e
pop ecx
pop ecx
push 0x4c0020
push 0x4c001c
call fcn.004b7a2e
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b7a0a
call fcn.004b7a25
pop edi
ret
push dword [esp + 8]
mov dword [0x4c4d44], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4b84e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0370
cmp edx, dword [eax]
je 0x4b8507
add eax, 8
inc ecx
cmp eax, 0x4c0400
jl 0x4b84f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0370]
jne 0x4b8635
mov eax, dword [0x4c4d00]
cmp eax, 1
je 0x4b860f
test eax, eax
jne 0x4b8538
cmp dword [0x4c029c], 1
je 0x4b860f
cmp edx, 0xfc
je 0x4b8635
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b856f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b8ed0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9360
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b85b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9360
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd974
push edi
call fcn.004bb230
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b8ed0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8ee0
lea eax, [ebp - 0xa0]
push 0x4bd954
push eax
call fcn.004b8ee0
push dword [esi + 0x4c0374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8ee0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bb1a4
add esp, 0x2c
pop edi
jmp 0x4b8635
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0374]
push 0
push eax
push dword [esi]
call fcn.004b9360
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4bbeaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and word [ebx], 0
mov byte [ebx + 2], 0x20
mov byte [ebx + 3], 1
mov byte [ebx + 4], 0x30
jmp 0x4bbfc2
xor esi, dword [ecx + edx - 0x75]
jge 0x4bbec4
movsx eax, si
add edi, eax
test edi, edi
jg 0x4bbec1
jmp 0x4bbdaf
cmp edi, 0x15
jle 0x4bbec9
push 0x15
pop edi
movzx esi, word [ebp - 6]
sub esi, 0x3ffe
and word [ebp - 6], 0
mov dword [ebp + 0x1c], 8
lea eax, [ebp - 0x10]
push eax
call fcn.004bb745
dec dword [ebp + 0x1c]
pop ecx
jne 0x4bbedf
test esi, esi
jge 0x4bbf09
neg esi
and esi, 0xff
jle 0x4bbf09
lea eax, [ebp - 0x10]
push eax
call fcn.004bb773
dec esi
pop ecx
jne 0x4bbefc
lea ecx, [edi + 1]
lea eax, [ebx + 4]
test ecx, ecx
mov dword [ebp + 0x1c], eax
jle 0x4bbf66
mov dword [ebp + 0x14], ecx
lea esi, [ebp - 0x10]
lea edi, [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x10]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004bb745
lea eax, [ebp - 0x10]
push eax
call fcn.004bb745
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004bb6e7
lea eax, [ebp - 0x10]
push eax
call fcn.004bb745
mov al, byte [ebp - 5]
mov ecx, dword [ebp + 0x1c]
and byte [ebp - 5], 0
add esp, 0x14
add al, 0x30
inc dword [ebp + 0x1c]
dec dword [ebp + 0x14]
mov byte [ecx], al
jne 0x4bbf19
mov eax, dword [ebp + 0x1c]
mov cl, byte [eax - 1]
dec eax
dec eax
cmp cl, 0x35
lea ecx, [ebx + 4]
jl 0x4bbfa3
cmp eax, ecx
jb 0x4bbf86
cmp byte [eax], 0x39
jne 0x4bbf82
mov byte [eax], 0x30
dec eax
jmp 0x4bbf73
cmp eax, ecx
jae 0x4bbf8a
inc eax
inc word [ebx]
inc byte [eax]
sub al, bl
sub al, 3
mov byte [ebx + 3], al
movsx eax, al
and byte [eax + ebx + 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
cmp eax, ecx
jb 0x4bbfb3
cmp byte [eax], 0x30
jne 0x4bbfaf
dec eax
jmp 0x4bbfa3
cmp eax, ecx
jae 0x4bbf8c
and word [ebx], 0
mov byte [ebx + 2], 0x20
mov byte [ebx + 3], 1
mov byte [ecx], 0x30
and byte [ebx + 5], 0
push 1
pop eax
jmp 0x4bbf9e
Function at 0x4014bb
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x460], 2
jne 0x401523
lea ebx, [edi + 0x470]
lea eax, [edi + 0x46c]
push ebx
push eax
call fcn.0040f08b
mov esi, eax
test esi, esi
jns 0x4014fa
push str.Failed_to_create_implicit_elevated_connection_name_and_secret.
jmp 0x401663
push dword [edi + 0x4a0]
push dword [ebx]
push dword [edi + 0x46c]
push dword [edi + 0x2c]
push dword [ebp + 0xc]
call fcn.0040f497
mov esi, eax
test esi, esi
jns 0x401523
push str.Failed_to_launch_unelevated_process.
jmp 0x401663
push 1
lea eax, [edi + 0x46c]
push eax
call fcn.0040ee2a
mov esi, eax
test esi, esi
jns 0x401541
push str.Failed_to_connect_to_unelevated_process.
jmp 0x401663
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 0x464], eax
cmp eax, 0xffffffff
jne 0x40158a
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1c2
push str.engine.cpp
call fcn.0042fef9
push str.Failed_to_allocate_thread_local_storage_for_logging.
jmp 0x401663
push dword [edi + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x4015d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1c7
push str.engine.cpp
call fcn.0042fef9
push str.Failed_to_set_elevated_pipe_into_thread_local_storage_for_logging.
jmp 0x401663
push edi
push dword [ebp + 8]
call fcn.00417730
mov esi, eax
test esi, esi
jns 0x4015e9
push str.Failed_to_create_the_message_window.
jmp 0x401663
push 1
call fcn.00433002
push edi
push 0x401124
call fcn.00430cc1
lea eax, [edi + 0x18]
push eax
lea eax, [edi + 0xf4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0xb8]
push eax
lea eax, [edi + 0xf8]
push eax
lea eax, [edi + 0x88]
push eax
lea eax, [edi + 0x2a0]
push eax
lea eax, [edi + 0x2a8]
push eax
lea eax, [edi + 0x290]
push eax
push dword [edi + 0x480]
push dword [edi + 0x47c]
push dword [edi + 0x464]
call fcn.004161c8
push 0
push 0
mov esi, eax
call fcn.00430cc1
test esi, esi
jns 0x40166b
push str.Failed_to_pump_messages_from_parent_process.
push esi
call fcn.00430877
pop ecx
pop ecx
push 0
push 0
call fcn.00430cc1
push edi
call fcn.004176f1
cmp dword [ebp - 8], 0
je 0x401685
call fcn.004162ef
cmp dword [ebp - 4], 0
je 0x40169d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401928
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov edi, ebx
test eax, eax
je 0x4019eb
cmp word [eax], bx
je 0x4019eb
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x4019a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x20f
push str.engine.cpp
call fcn.0042fef9
push str.Failed_to_get_command_line.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x401a48
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jle 0x4019eb
mov ecx, dword [edi + esi*4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x4019bd
cmp eax, 0x2f
jne 0x4019d9
push 0xffffffffffffffff
push 0x43b530
push 0xffffffffffffffff
lea eax, [ecx + 2]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x4019e5
push dword [edi + esi*4]
lea eax, [ebp - 4]
push eax
call fcn.004310c7
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x4019ad
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00431a39
mov esi, eax
test esi, esi
jns 0x401a0a
push str.Failed_to_get_current_process_path.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x401a3d
cmp dword [ebp - 4], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov eax, 0x43b580
cmova eax, dword [ebp - 4]
push eax
push dword [ebp - 8]
call fcn.00431cee
mov esi, eax
test esi, esi
jns 0x401a3d
push dword [ebp - 8]
push str.Failed_to_re_launch_bundle_process_after_RunOnce:__ls
push esi
call fcn.00430877
add esp, 0xc
test edi, edi
je 0x401a48
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
je 0x401a59
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 4], ebx
je 0x401a66
push dword [ebp - 4]
call fcn.00434266
cmp dword [ebp - 8], ebx
je 0x401a73
push dword [ebp - 8]
call fcn.00434266
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x405a14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x405a41
push str.Failed_to_format_variable_string.
jmp 0x405ab5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405a77
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x405a73
cmp esi, 0x80070003
jne 0x405a7f
xor esi, esi
jmp 0x405a7f
test al, 0x10
push 1
pop eax
cmovne edi, eax
test esi, esi
jns 0x405a98
push dword [ebp - 4]
push dword [ebx]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00430877
add esp, 0x10
jmp 0x405abd
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.004044b1
mov esi, eax
test esi, esi
jns 0x405abd
push str.Failed_to_set_variable.
push esi
call fcn.00430877
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x405acb
push dword [ebp - 4]
call fcn.00434266
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x405ad4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x405aff
push str.Failed_to_format_variable_string.
jmp 0x405b42
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405b23
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x405b51
test al, 0x10
je 0x405b4c
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004044f1
mov esi, eax
test esi, esi
jns 0x405b51
push str.Failed_to_set_directory_search_path_variable.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x405b91
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x405b7a
cmp esi, 0x80070003
je 0x405b7a
test esi, esi
jns 0x405b91
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.00430877
add esp, 0x10
jmp 0x405b91
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.00430d48
add esp, 0x14
xor esi, esi
cmp dword [ebp - 4], 0
je 0x405b9f
push dword [ebp - 4]
call fcn.00434266
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x405ba7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x14]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x405bd7
push str.Failed_to_format_variable_string.
jmp 0x405c6f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405c4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405c34
cmp eax, 3
je 0x405c34
test eax, eax
je 0x405c52
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x27d
push str.search.cpp
call fcn.0042fef9
push dword [ebx + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.00430877
add esp, 0xc
jmp 0x405c77
push dword [ebp - 4]
push dword [ebx]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00430d48
add esp, 0x10
jmp 0x405c52
test al, 0x10
push 1
pop eax
cmove edi, eax
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.004044b1
mov esi, eax
test esi, esi
jns 0x405c77
push str.Failed_to_set_variable.
push esi
call fcn.00430877
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x405c85
push dword [ebp - 4]
call fcn.00434266
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x405c8e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x405cb9
push str.Failed_to_format_variable_string.
jmp 0x405d23
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp esi, 0x80070002
je 0x405d2d
cmp esi, 0x80070003
je 0x405d2d
test esi, esi
jns 0x405d43
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.00430877
add esp, 0x10
jmp 0x405d43
test al, 0x10
jne 0x405d2d
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.004044f1
mov esi, eax
test esi, esi
jns 0x405cdb
push str.Failed_to_set_variable_to_file_search_path.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x405d43
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.00430d48
add esp, 0x10
xor esi, esi
cmp dword [ebp - 4], 0
je 0x405d51
push dword [ebp - 4]
call fcn.00434266
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x406158
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edx, edx
xor edi, edi
inc edi
cmp dword [ebx + 0x24], edx
mov ecx, 0x101
mov eax, edi
cmovne eax, ecx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0x1c]
mov dword [ebp - 4], edx
push dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x4061a5
push str.Failed_to_format_key_string.
jmp 0x40623b
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebx + 0x18]
call fcn.004322f5
mov esi, eax
test esi, esi
js 0x40625c
cmp dword [ebx + 0x20], 0
je 0x406278
push 0
lea eax, [ebp - 8]
push eax
push dword [ebx + 0x20]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x4061e9
push str.Failed_to_format_value_string.
jmp 0x40623b
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
sub ecx, 0
je 0x406278
dec ecx
dec ecx
je 0x406245
test eax, eax
je 0x406278
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x30f
push str.search.cpp
call fcn.0042fef9
push str.Failed_to_query_registry_key_value.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x4062a5
push dword [ebp - 8]
push dword [ebp - 4]
push str.Registry_value_not_found._Key___ls__Value___ls
push 2
call fcn.00430d48
add esp, 0x10
jmp 0x406276
push dword [ebp - 4]
cmp esi, 0x80070002
jne 0x406297
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00430d48
add esp, 0xc
xor edi, edi
push 0
mov eax, edi
cdq
push edx
push eax
push dword [ebx + 4]
push dword [ebp + 0xc]
call fcn.004044b1
mov esi, eax
test esi, esi
jns 0x4062bc
push str.Failed_to_set_variable.
jmp 0x40623b
push str.Failed_to_open_registry_key._Key___ls
push esi
call fcn.00430877
add esp, 0xc
test esi, esi
jns 0x4062bc
push esi
push dword [ebp - 4]
push str.RegistrySearchExists_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00430d48
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x4062ca
push dword [ebp - 4]
call fcn.00434266
cmp dword [ebp - 8], 0
je 0x4062d8
push dword [ebp - 8]
call fcn.00434266
cmp dword [ebp - 0xc], 0
je 0x4062e7
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8