joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405fb0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43e218
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push eax
mov dword [esp + 0x30], 0
call fcn.00402880
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.00403190
test al, al
jne 0x406174
mov eax, dword [esp + 0x30]
push 0x5c
push eax
call fcn.00424db0
add esp, 8
test eax, eax
jne 0x406023
or eax, 0xffffffff
jmp 0x406027
sub eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call fcn.00403cc0
mov ebp, dword [esp + 0x14]
push ecx
add ebp, 0xfffffff0
mov dword [esp + 0x1c], esp
mov edi, esp
push ebp
mov byte [esp + 0x30], 1
call fcn.00402880
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.00405fb0
call fcn.00417947
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406078
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
push 0
push ecx
mov byte [esp + 0x30], 2
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4060b7
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x14]
push str.Could_not_create_directory:__s
push eax
call fcn.00404d40
add esp, 0xc
jmp 0x406105
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x1c]
push str.Created_directory:
push edx
call fcn.004052c0
mov eax, dword [eax]
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x3c], 3
call fcn.00404d40
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 0x14
mov byte [esp + 0x28], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406105
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push esi
call fcn.00402880
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x2c], 4
call fcn.004038f0
mov ecx, eax
mov byte [esp + 0x2c], 2
call fcn.00404f60
mov byte [esp + 0x28], 1
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406155
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x28], 0
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406174
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40619c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 4
Function at 0x408870
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43e756
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x44ef30]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMentorGraphicsMentorGraphicsJI
mov dword [esp + 0x1c], 0
push 0x80000002
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408964
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.InstPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408911
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004087b0
jmp 0x4089e3
call fcn.00417947
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40892b
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
push str.InstPath
push str.SOFTWAREMentorGraphicsMentorGraphicsJI
lea ecx, [esp + 0x10]
push str.Could_not_open_registry_key__s_s_n
push ecx
mov dword [esp + 0x134], 1
call fcn.00404d40
add esp, 0x10
jmp 0x4089b0
call fcn.00417947
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40897e
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
push str.SOFTWAREMentorGraphicsMentorGraphicsJI
lea ecx, [esp + 0xc]
push str.Could_not_open_registry_key__s_n
push ecx
mov dword [esp + 0x130], 0
call fcn.00404d40
add esp, 0xc
push 0x441769
mov ecx, esi
call fcn.004087b0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov dword [esp + 0x124], ecx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4089e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00425da1
add esp, 0x120
ret
Function at 0x414500
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov ebp, ecx
cmp dword [ebp + 0x3c], 8
jae 0x414624
cmp dword [ebp + 0x1c], 0
jne 0x414529
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
call fcn.00413e50
mov esi, dword [eax + 0x18]
mov eax, dword [eax]
mov edx, dword [esi]
mov ecx, eax
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
jmp 0x414550
test ecx, ecx
je 0x414558
cmp ecx, eax
je 0x41455d
call fcn.004259ab
cmp dword [esp + 0x24], esi
je 0x4145c1
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00413ee0
mov ecx, dword [eax]
mov ebx, dword [ebp + 0x38]
mov edi, dword [ebp + 0x20]
add esp, 8
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
lea ecx, [ebp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00414200
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x41459c
cmp eax, edi
je 0x4145a1
call fcn.004259ab
cmp dword [esi + 4], ebx
je 0x41451f
lea ecx, [esp + 0x20]
call fcn.00401ff0
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
jmp 0x414550
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [ebp + 0x20]
mov dword [esp + 0x24], 6
call fcn.00414080
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov dword [esp + 0x2c], 0
call fcn.00413f70
mov eax, dword [0x4504a8]
add esp, 0x18
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x414624
cmp dword [esp + 0x14], 0
jbe 0x41451f
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415160
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Logic
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Logic_Viewer
call fcn.004087b0
call fcn.00413fb0
mov esi, dword [esp + 0x18]
push str.powerlogic.ini
lea eax, [esp + 0x10]
push esi
push eax
call fcn.004051e0
mov ecx, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
push ecx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4151d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.powerlogicviewer.ini
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0xc
push edx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415208
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ecx
ret
Function at 0x415210
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Layout
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Layout_Translator
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Layout_Viewer
call fcn.004087b0
call fcn.00413fb0
mov esi, dword [esp + 0x18]
push str.powerpcbviewer.ini
lea eax, [esp + 0x10]
push esi
push eax
call fcn.004051e0
mov ecx, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
push ecx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415295
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.powerpcb.ini
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0xc
push edx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4152cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.pads2sp.ini
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0xc
push edx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415305
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.ppcb2hkp.ini
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0xc
push edx
call edi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41533d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ecx
ret

Function at 0x415350
Capabilities:
Delete file

Disassembly:
push ecx
push ecx
mov ecx, esp
mov dword [esp + 4], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Router
call fcn.004087b0
call fcn.00413fb0
mov eax, dword [esp + 0xc]
push str.padswin32_blazerouter.reg
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4153a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ecx
ret
Function at 0x4153b0
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS_Projects
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5PADS
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS9_5
call fcn.004087b0
call fcn.00413fb0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.SOFTWAREMentor_GraphicsPADS
call fcn.004087b0
call fcn.00413fb0
mov edi, dword [esp + 0x14]
push str.CAMCADVCREDIST_vs2005_vcredist_x86.txt
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004051e0
mov ecx, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
push ecx
call esi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41544a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.CAMCADVCREDIST_vs2008_vcredist_x86.txt
lea ecx, [esp + 0xc]
push edi
push ecx
call fcn.004051e0
mov edx, dword [eax]
add esp, 0xc
push edx
call esi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415482
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push str.davenavigator.ini
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004051e0
mov eax, dword [eax]
add esp, 0xc
push eax
call esi
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4154be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ecx
ret
Function at 0x416610
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x43faf8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x41671e
lea ecx, [esp + 0xc]
call fcn.0040c1b0
mov eax, dword [esi]
xor ebx, ebx
mov byte [esp + 0x54], bl
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push ecx
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x18]
push edx
add ecx, eax
push ecx
push eax
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x68], ebx
call fcn.00416590
add esp, 0x1c
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x58], bl
call fcn.00416390
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x58], bl
call fcn.00416390
mov edx, dword [esp + 0x1c]
sub edx, dword [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 3
jne 0x4166c7
call fcn.004259ab
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
mov ecx, 0x54
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
mov word [esp + 0x38], cx
mov dword [esp + 0x3a], ebx
mov dword [esp + 0x42], ebx
mov dword [esp + 0x3e], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x416705
push eax
call fcn.00417568
add esp, 4
mov eax, dword [esp + 0xc]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00417568
add esp, 4
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x416bc0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x43fb88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [ebx + 0x44]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x416d8f
mov ecx, dword [ebx + 0x48]
cmp dword [ecx - 0xc], 0
je 0x416d8f
call fcn.00416730
mov ecx, dword [eax + 0x18]
mov ebp, dword [ecx]
mov edi, dword [eax]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], edi
lea esp, [esp]
call fcn.00416730
mov esi, dword [eax + 0x18]
mov eax, dword [eax]
test edi, edi
je 0x416c32
cmp edi, eax
je 0x416c37
call fcn.004259ab
lea edx, [esp + 0x1c]
cmp ebp, esi
je 0x416d2f
push 0x441bc8
lea eax, [ebx + 0x48]
push eax
push edx
call fcn.004051e0
add esp, 0xc
mov esi, eax
mov dword [esp + 0x3c], 0
test edi, edi
jne 0x416d24
call fcn.004259ab
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x416c78
call fcn.004259ab
lea eax, [ebp + 0xc]
push eax
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00405120
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
mov eax, dword [esp + 0x18]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416cb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416ce1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x416d0a
test edi, edi
jne 0x416d2b
call fcn.004259ab
cmp ebp, dword [edi + 0x18]
jne 0x416cf8
call fcn.004259ab
add ebp, 0x10
push ebp
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415580
lea ecx, [esp + 0x20]
call fcn.00413cc0
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
jmp 0x416c20
mov eax, dword [edi]
jmp 0x416c6e
mov edi, dword [edi]
jmp 0x416cee
push 0x4504a0
lea eax, [ebx + 0x44]
push eax
push edx
call fcn.00405120
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
mov eax, dword [esp + 0x1c]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416d70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x416d8f
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x24], 7
call fcn.00415580
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x417340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43fcc9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44ef30]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x24], esi
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x1b]
push ecx
mov ecx, esi
call fcn.00414630
lea edx, [esp + 0x17]
push edx
lea eax, [esp + 0x1b]
lea ecx, [esi + 0x20]
push eax
mov dword [esp + 0x38], 0
call fcn.004148c0
lea edi, [esi + 0x44]
push 0x450490
push edi
mov byte [esp + 0x38], 1
mov byte [esi + 0x40], 0
call fcn.004150a0
lea ecx, [esp + 0x24]
push 0x45049c
push ecx
mov byte [esp + 0x40], 2
call fcn.004150a0
mov ebx, eax
push 0x441bc8
lea edx, [esp + 0x2c]
push edi
push edx
mov byte [esp + 0x4c], 3
call fcn.004051e0
push ebx
push eax
lea ebp, [esi + 0x48]
push ebp
mov byte [esp + 0x58], 4
call fcn.00405120
add esp, 0x28
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x30], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417412
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov bl, 7
add eax, 0xfffffff0
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417438
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp]
push 0x441bc8
push eax
call fcn.00424875
add esp, 8
test eax, eax
sete al
test al, al
je 0x417460
push 0x12
push str.SDD_HOMEPrograms
mov ecx, ebp
call fcn.00403650
mov ecx, dword [edi]
cmp dword [ecx - 0xc], 0
jne 0x4174ef
lea edx, [esp + 0x20]
push 0x450494
push edx
call fcn.004150a0
add esp, 8
push eax
mov ecx, edi
mov byte [esp + 0x34], 8
call fcn.00404ac0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4174af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.00405120
add esp, 0xc
push eax
mov ecx, ebp
mov byte [esp + 0x34], 9
call fcn.00404ac0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x30], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4174ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00416bc0
mov ecx, esi
call fcn.00417120
mov ecx, esi
call fcn.00414500
mov byte [esi + 0x40], al
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x425da1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ef30]
jne 0x425dab
repz ret
jmp fcn.00430aac
Function at 0x425db0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x425de1
call fcn.00427801
mov dword [eax], esi
call fcn.004277ee
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00425985
add esp, 0x14
push 0x16
pop eax
jmp 0x425e36
test dword [ebp + 0xc], 0xfffffff9
jne 0x425dbd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x425e0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00427814
pop ecx
call fcn.004277ee
mov eax, dword [eax]
jmp 0x425e36
test al, 0x10
jne 0x425e34
test al, 1
je 0x425e34
test byte [ebp + 0xc], 2
je 0x425e34
call fcn.00427801
mov dword [eax], 5
call fcn.004277ee
mov dword [eax], 0xd
jmp 0x425e05
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4357c7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042d357
and dword [ebp - 4], 0
cmp dword [0x452cfc], 0
mov ebx, eax
jne 0x435878
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x435929
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x445084
push edi
call esi
test eax, eax
je 0x435929
push eax
call fcn.0042d2e5
mov dword [esp], 0x445074
push edi
mov dword [0x452cfc], eax
call esi
push eax
call fcn.0042d2e5
mov dword [esp], 0x445060
push edi
mov dword [0x452d00], eax
call esi
push eax
call fcn.0042d2e5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x452d04], eax
call esi
push eax
call fcn.0042d2e5
pop ecx
mov dword [0x452d0c], eax
test eax, eax
je 0x435878
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042d2e5
pop ecx
mov dword [0x452d08], eax
mov eax, dword [0x452d08]
cmp eax, ebx
je 0x4358d0
cmp dword [0x452d0c], ebx
je 0x4358d0
push eax
call fcn.0042d360
push dword [0x452d0c]
mov esi, eax
call fcn.0042d360
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4358d0
test edi, edi
je 0x4358d0
call esi
test eax, eax
je 0x4358c7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4358c7
test byte [ebp - 0xc], 1
jne 0x4358d0
or dword [ebp + 0x10], 0x200000
jmp 0x435909
mov eax, dword [0x452d00]
cmp eax, ebx
je 0x435909
push eax
call fcn.0042d360
pop ecx
test eax, eax
je 0x435909
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x435909
mov eax, dword [0x452d04]
cmp eax, ebx
je 0x435909
push eax
call fcn.0042d360
pop ecx
test eax, eax
je 0x435909
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x452cfc]
call fcn.0042d360
pop ecx
test eax, eax
je 0x435929
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43592b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419dff
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x6830ec
push eax
call fcn.0060b7a0
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x41acca
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
push 0
lea eax, [esi + 0x10]
push eax
call fcn.0060b7a0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret